Splunk Search

Find earliest events by category

Jordan_Brough
Path Finder

I'd like to select the earliest events broken down by category.

i.e. I would like to see something like this:

error | stats earliest(_raw) as earliest_raw by error_category | ...

That pretty much gives me what I need, but it's a little inconvenient that 1) now I have to work off of "earliest_raw" and 2) the event list view doesn't show anything.

Is there a better way? What I'd really like to do is something like:

error | earliest by error_category | ...
Tags (2)
0 Karma
1 Solution

Jordan_Brough
Path Finder

aholzer's answer worked great:

error | dedup category sortby +_time | ...

Thanks!

View solution in original post

0 Karma

Jordan_Brough
Path Finder

aholzer's answer worked great:

error | dedup category sortby +_time | ...

Thanks!

0 Karma

Jordan_Brough
Path Finder

I'm not sure how to use head/tail since I also need to group by category, but dedup:

dedup category sortby +_time

worked like a charm! Thanks!

0 Karma

aholzer
Motivator

You may want to consider using one of the following:
- dedup with a sort by time
error | dedup error_category sort by +_time
- the head command or the tail command depending how you want to look at your events

Just remember that you can perform checks on the field "_time" to get the earliest

Hope this helps

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...