Earliest event in a sourcetype

[mcm10285]

Is there a way to know the earliest event of a specific sourcetype and if the actual event can be viewed for validation?

I tried the following but it returned an epoch time (earliest and latest) for different sourcetypes which I cannot validate by seeing the actual event.

| metadata type=sourcetypes sourcetype=proofpoint | stats min(firstTime) as firstTime

[justinatpnnl]

You could use the metadata command as a subsearch, getting the firstTime as the latest time that Splunk should look at:

sourcetype=proofpoint 
    [| metadata type=sourcetypes 
    | search sourcetype=proofpoint 
    | stats min(firstTime) as latest by sourcetype 
    | eval latest=latest+1] 
| stats earliest(_time) as _time, earliest(_raw) as event by sourcetype

I tried this on a few of my sourcetypes and it seemed to do the trick. A couple of notes:

1. Set your timepicker to "All Time"
2. By setting the minimum firstTime to latest in the subsearch, we are overriding the timepicker to use to search for anything older than the minimum firstTime we found.
3. I added one to the latest time in the subsearch because Splunk translates latest=timestamp as _time

[eckolp2003]

Proofpoint now has a beta app that will allow you report on and visualze your Proofpoint Protection Server and TAP data! Check out the new app here:

https://splunkbase.splunk.com/app/3727/#/details

Be sure to follow the instructions listed in the details to get all the needed TA's etc that the app needs to work correctly.

[sowings]

The metadata search command won't show you events, just the "meta" data (hence the name) in the system catalog. If you want to see events of a certain sourcetype, you could just search for those:

search sourcetype=foo

To find the chronological first of these, you could try:

search sourcetype=foo | tail

(remembering that Splunk returns newest events first, and oldest events last).

[MarioM]

do you mean you want a human readable date/time ? if yes add this to your search:

| convert ctime(firstTime)