Splunk Search

How to dynamically set earliest time to the first instance of a particular event for a timechart?

pde7
Explorer

I want to dynamically set the earliest time to the first instance of a particular event. Is there a way to do that?

Basically/roughly, I'm looking for something like:

value=pair earliest=(timestamp of first event) latest=+7d | timechart

0 Karma

Ayn
Legend

You can't do it in the base search, because Splunk sets up the timeframe before it even finds any events. What you could do though is to post-filter the events once they've been returned from the base search.

value=pair earliest=sometime latest=sometime | eventstats earliest(_time) as earliest_time | where _time<relative_time(earliest_time,"+7d")
0 Karma

pde7
Explorer

That works but it is extremely expensive (programming/search cost).

0 Karma

Ayn
Legend

Correct. However as you can't put the logic in at an earlier stage, this is what you're likely stuck with. I suppose you could maybe use a subsearch for generating the correct times, but you're still back to the problem of finding the earliest event. Splunk searches in reverse chronological order so in order to find the earliest event, it has to find all the ones after that anyway.

0 Karma

landen99
Motivator

how about using map to give a time frame for each field-value pair?

| eval time_b4=relative_time(time_anchor, "-1h")  | eval time_l8r=relative_time(time_anchor, "+1h") | map search="search index=index1 sourcetype=sourcetype1 field1=$field$  earliest=$time_b4$ latest=$time_l8r$"

Something like that maybe?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...