Splunk Search

Get fields associated with the earliest event in a search

aaloisi
Explorer

Hi all,

I am still a Splunk novice but I am looking for some help using the earliest command. I am calculating a duration from the beginning of my search period to the first event in the search period. For example, lets say the time frame is from 08:00 - 09:00 and the first event is seen at 08:15. This is my code :

| stats earliest(_time) as FirstEvent
| addinfo 
| eval duration=(FirstEvent - info_min_time)

So I am, able to get the timestamp of the earliest event at 08:15 BUT I would also like to get the fields associated with that earliest event. I have tried using two earliest commands but one overrides the other. In short, how do I get the fields associated with the (earliest) 08:15 event?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The problem with stats as it's used here is it discards all fields except those it uses. In this case, it means only the FirstEvent field is available to later commands. To get the other fields from the events, you must include them in the stats command.

| stats earliest(_time) as FirstEvent. values(*) as *
| addinfo 
| eval duration=(FirstEvent - info_min_time)
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The problem with stats as it's used here is it discards all fields except those it uses. In this case, it means only the FirstEvent field is available to later commands. To get the other fields from the events, you must include them in the stats command.

| stats earliest(_time) as FirstEvent. values(*) as *
| addinfo 
| eval duration=(FirstEvent - info_min_time)
---
If this reply helps you, Karma would be appreciated.

aaloisi
Explorer

So adding the "values" to the stats gets really close to what I need but not exactly. Values returns a list of the distinct values of field X. In my case there are 2 distinct values. I want the current value of field X at time=earliest (08:15).

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try earliest instead of values.

---
If this reply helps you, Karma would be appreciated.

aaloisi
Explorer

Thanks @richgalloway this is exactly what I needed!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...