How to extract the earliest and latest dates for a certain time range to filter the values of a lookup containing a list of dates?

[gcusello]

I need to extract the first and the last dates of a period to use to filter the values of a lookup table containing a list of dates.

I have to do this because, in addition to the Timestamp, I also have to search events by indextime and put these dates in a drop-down list, but I cannot load the list at search-time because there are too many events, so I loaded the list in a lookup (updated every night). However, in my forms, I have to correlate this list to the Time period.

I cannot use head and tail commands because I have too many events (head command is fast, but tail is very slow!)

Is it possible to extract dates from the earliest and latest values?

Thank you.

Giuseppe

[gcusello · Accepted solution]

I solved the problem in a different way: insted to use a lookup I used an index in which every event countains only a date and the timestamp is the same.
In this way I can find the values I need.

[sundareshr]

Have you tried ..| stats max(_time) as l and min(_time) as e

[gcusello]

it doesn't work,
but the problem is that calculating max and min is everyway very slow.
The problem is that Splunk read all the events from the latest event to the earliest, so the "head 1" command is very fast, but istead the "tail 1" command is very very slow because the search starts from the latest event.
If I could start the search from the earliest event, it will be very fast.
Thank you.
Bye.
Giuseppe

[gcusello]

maybe a way to proceed is to associate a timestamp to the lookup items, like:

| inputlookup lookuptable.csv | eval _time=strftime(strptime(Data1,"%Y/%m/%d"),"%Y-%m-%d 00.00.00")

but it doesn't work!