Splunk Search

How do I return the time of the first event from a specific host in the main index?

MikeyG
Explorer

Need to determine the date and time of when a specific host first logged to Splunk ...

Tags (1)
0 Karma
1 Solution

ziegfried
Influencer

If you're looking for the date/time of the event (ie. what the value Splunk has extracted from the Event), use this search:

single host:

| metadata type=hosts index=main | search host=<YOUR HOST> | convert ctime(firstTime) | table host firstTime

all hosts:

| metadata type=hosts index=main | convert ctime(firstTime) | table host firstTime

If you're looking for when the first event has been indexed use this search: (Select All time in the time range picker - may take a while)

single host:

index=main host=<YOUR HOST> | stats min(_indextime) as mintime by host | convert ctime(mintime) | table host mintime

all hosts:

index=main | stats min(_indextime) as mintime by host | convert ctime(mintime) | table host mintime

View solution in original post

MikeyG
Explorer

That time/date would be outside the data that's currently in the main index ...

0 Karma

ziegfried
Influencer

If you're looking for the date/time of the event (ie. what the value Splunk has extracted from the Event), use this search:

single host:

| metadata type=hosts index=main | search host=<YOUR HOST> | convert ctime(firstTime) | table host firstTime

all hosts:

| metadata type=hosts index=main | convert ctime(firstTime) | table host firstTime

If you're looking for when the first event has been indexed use this search: (Select All time in the time range picker - may take a while)

single host:

index=main host=<YOUR HOST> | stats min(_indextime) as mintime by host | convert ctime(mintime) | table host mintime

all hosts:

index=main | stats min(_indextime) as mintime by host | convert ctime(mintime) | table host mintime
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...