Splunk Search

Get fields associated with the earliest event in a search

aaloisi
Explorer

Hi all,

I am still a Splunk novice but I am looking for some help using the earliest command. I am calculating a duration from the beginning of my search period to the first event in the search period. For example, lets say the time frame is from 08:00 - 09:00 and the first event is seen at 08:15. This is my code :

| stats earliest(_time) as FirstEvent
| addinfo 
| eval duration=(FirstEvent - info_min_time)

So I am, able to get the timestamp of the earliest event at 08:15 BUT I would also like to get the fields associated with that earliest event. I have tried using two earliest commands but one overrides the other. In short, how do I get the fields associated with the (earliest) 08:15 event?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The problem with stats as it's used here is it discards all fields except those it uses. In this case, it means only the FirstEvent field is available to later commands. To get the other fields from the events, you must include them in the stats command.

| stats earliest(_time) as FirstEvent. values(*) as *
| addinfo 
| eval duration=(FirstEvent - info_min_time)
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The problem with stats as it's used here is it discards all fields except those it uses. In this case, it means only the FirstEvent field is available to later commands. To get the other fields from the events, you must include them in the stats command.

| stats earliest(_time) as FirstEvent. values(*) as *
| addinfo 
| eval duration=(FirstEvent - info_min_time)
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

aaloisi
Explorer

So adding the "values" to the stats gets really close to what I need but not exactly. Values returns a list of the distinct values of field X. In my case there are 2 distinct values. I want the current value of field X at time=earliest (08:15).

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try earliest instead of values.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

aaloisi
Explorer

Thanks @richgalloway this is exactly what I needed!

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.