How could I edit my search command in order to filter this table which will display the earliest time of the same value(

[Jennifer]

Hi, all!

How could I edit my search command in order to filter this table which will display the earliest time of the same value(Call_Session_ID)? 

Here is my original search command:

index="hkcivr" source="/appvol/wlp/DIVR01HK-AS01/applogs/progresshk.log*"| table Time Call_Session_ID

[richgalloway · Accepted solution]

I'm not certain what you want as a final result, but perhaps this will help.

index="hkcivr" source="/appvol/wlp/DIVR01HK-AS01/applogs/progresshk.log*"
| stats min(_time) as Time by Call_Session_ID
| table Time Call_Session_ID