First & Last Occurrence of a Field

[colinmchugo]

Hi,

Is there a way of discovering when an a field (e.g. like an IP address or MAC address) was first seen in the index? So i can pull out the data for the last time it was seen (which would be the default) but id also like to see when this was first seen and pull the time stamp and other data if possible?

thanks in advance

C.

[rjthibod]

If you want the most accurate (in terms of timestamp, not indexing-time), then you should use min(_time). For example, use this query where you swap out the values for your base search and field name.

<YOUR_BASE_SEARCH> <YOUR_FIELD>=* | stats min(_time) as earliest by <YOUR_FIELD>

A faster way that relies on indexing-time, not the raw timestamp, is using earliest(_time).

<YOUR_BASE_SEARCH> <YOUR_FIELD>=* | stats earliest(_time) as earliest by <YOUR_FIELD>

Usually these two will return the same values, but that is not guaranteed, e.g., events get stuck in a queue and get indexed some time later.