I need to get the very oldest log event displayed on a dashboard , any tricks to speeding this up?

[daniel333]

All,

I need to make a dashboard providing evidence of compliance for our auditors. I was going to use the tail command but it's VERY slow even with the fact I only have a few hundred megs of data right now. Any tricks here to speed this up?

index=os source=/var/log/secure | table _raw | tail  1

[FrankVl]

Do you need the actual event itself, or just the timestamp of the oldest event?

For the latter, a | metadata search would be most efficient I guess. So something along the lines of:

| metadata type=sources index=os source=/var/log/secure 
| table firstTime,source 
| convert ctime(firstTime)

[daniel333]

I actually need the entire event actually. But good call on the metadata command. Cool stuff.

[masonmorales · Accepted solution]

 index=os source=/var/log/secure  | stats earliest(_raw) as _raw

[adonio]

start by tailing before tableing
you are passing all the events in the world through the table command only to look for the last one

 index=os source=/var/log/secure 
    | tail  1
    | table _raw