Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How do I return the time of the first event from a...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Need to determine the date and time of when a specific host first logged to Splunk ...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you're looking for the date/time of the event (ie. what the value Splunk has extracted from the Event), use this search:
single host:
| metadata type=hosts index=main | search host=<YOUR HOST> | convert ctime(firstTime) | table host firstTime
all hosts:
| metadata type=hosts index=main | convert ctime(firstTime) | table host firstTime
If you're looking for when the first event has been indexed use this search: (Select All time in the time range picker - may take a while)
single host:
index=main host=<YOUR HOST> | stats min(_indextime) as mintime by host | convert ctime(mintime) | table host mintime
all hosts:
index=main | stats min(_indextime) as mintime by host | convert ctime(mintime) | table host mintime
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That time/date would be outside the data that's currently in the main index ...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you're looking for the date/time of the event (ie. what the value Splunk has extracted from the Event), use this search:
single host:
| metadata type=hosts index=main | search host=<YOUR HOST> | convert ctime(firstTime) | table host firstTime
all hosts:
| metadata type=hosts index=main | convert ctime(firstTime) | table host firstTime
If you're looking for when the first event has been indexed use this search: (Select All time in the time range picker - may take a while)
single host:
index=main host=<YOUR HOST> | stats min(_indextime) as mintime by host | convert ctime(mintime) | table host mintime
all hosts:
index=main | stats min(_indextime) as mintime by host | convert ctime(mintime) | table host mintime
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
What Is Splunk? Here’s What You Can Do with Splunk
Level Up Your .conf25: Splunk Arcade Comes to Boston
