Search in the earliest source

[ryastrebov]

Hello!
I have sourtsetype that contains multiple source. Into sourcetype permanently add new source. I need to search in the earliest source. For extract most earliest source I use this search request:

sourcetype="MySourceType" source=* NOT [ | inputlookup usedfiles.csv|fields source]| stats dc(source) by source | sort 1 by source | fields - dc(source) | outputlookup append=true usedfiles.csv

This search successfully return of earliest source name. How I can make search into this source? This search request is not working:

sourcetype="MySourceType" source=* NOT [ | inputlookup usedfiles.csv|fields source]| stats dc(source) by source | sort 1 by source | fields - dc(source) | outputlookup append=true usedfiles.csv | search Field="value"

[jstockamp · Accepted solution]

I would think you could just use the "earliest" function of stats - i.e.

sourcetype="mysourcetype" | stats earliest(source) as firstsource | search source=firstsource

[ryastrebov]

Thank you!
And as the search will proceed to the next source?