Finding the earliest event matching a query

[flaviadonno]

Hi all,
is there a quick way to find the earliest event (given the logtype and the index) matching a query ?

[lguinn2]

Or, if you are looking for a more generic solution:

yoursearchhere
| tail 1

Why tail and not head? Because Splunk returns the search results sorted so that the latest result comes first. So the last result will be the earliest.

Other variations are possible. For example, if I want to see the earliest time that each clientip address appeared in the results, along with the count:

yoursearchhere
| stats earliest(_time) as FirstAppearance count by clientip
| fieldformat FirstAppearance=strftime(FirstAppearance,"%x %X")

[flaviadonno]

Cool! Thank you!

[kristian_kolb]

If you by 'logtype' mean sourcetype;

| metadata type=sourcetypes index=your_indexname_here | convert ctime(firstTime) | fields - lastTime, recentTime, type

and yes, the search starts with a pipe (|)

/K