Hello,
In my lookup I have the following data:
_time='2020-10-21 15:00' usage='1' host='A'
_time='2020-10-26 15:00' usage='2' host='B'
_time='2020-10-21 16:00' usage='3' host='A'
_time='2020-10-23 18:00' usage='4' host='A'
_time='2020-10-24 15:00' usage='2' host='B'
I want to get only the earliest entry for each host so it will look like this:
host='A' _time='2020-10-21 15:00' usage='1'
host='B' _time='2020-10-24 15:00' usage='2'
How can I do it?
| stats earliest(_time) as _time earliest(usage) as usage by host
| stats earliest(_time) as _time earliest(usage) as usage by host