When calculating a minimum value across events how can you then retain an event field related to the minimum value and display the minimum value with the event field?
| eventstats min(field) as min_field
| where field=min_field
| table _time, field
I am trying to show the event date related to the min field value, along with the minimum value.
It would help to see your current query, but I think you want to try the eventstats command.
eventstats
| eventstats min(fieldname)