Splunk Search

How can I get the 10 oldest events of a search first and quickly?

daniel333
Builder

All,

Any idea how I get the 10 oldest events from the search below? I need it to validate that we have 90 days of retention for an audit. Seems like I should be able to go a head 10. Seems to be there should be a faster way of doing this rather than just using the head/tail functions?

index=* host=*dcs* sourcetype="WinEventLog:Security"
0 Karma
1 Solution

muebel
SplunkTrust
SplunkTrust

Hi daniel333, tstats looks like a good use here. For instance:

| tstats min(_time) as earliestTime where index=* host=*dcs* sourcetype="WinEventLog:Security" | convert ctime(earliestTime)

Run it over 90 or more days to get the minimum value for the events that match that search.

You could get a more informative look on retention by splitting by host, for instance:

    | tstats min(_time) as earliestTime where index=* host=*dcs* sourcetype="WinEventLog:Security" by host | convert ctime(earliestTime)

To get the raw events themselves, I'd just use a custom search time that has a narrow window, like earliest=-90d@d latest=-89d@d to make the search run faster

Please let me know if this answers your question! 😄

View solution in original post

0 Karma

muebel
SplunkTrust
SplunkTrust

Hi daniel333, tstats looks like a good use here. For instance:

| tstats min(_time) as earliestTime where index=* host=*dcs* sourcetype="WinEventLog:Security" | convert ctime(earliestTime)

Run it over 90 or more days to get the minimum value for the events that match that search.

You could get a more informative look on retention by splitting by host, for instance:

    | tstats min(_time) as earliestTime where index=* host=*dcs* sourcetype="WinEventLog:Security" by host | convert ctime(earliestTime)

To get the raw events themselves, I'd just use a custom search time that has a narrow window, like earliest=-90d@d latest=-89d@d to make the search run faster

Please let me know if this answers your question! 😄

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...