How to find earliest event based on Event code for once server?

[singhg]

Hi,

I am trging to find the first time the event ID 4656 was indexed for particular server.

the below search gives me only the first time any event was indexed for this server:
| metadata index=main type=hosts | search host="Name" | fields + host, firstTime | convert ctime(firstTime)

Do you know a command to do that?

[singhg]

Thanks cphair for your reply but when I run this i get this error:

Error in 'stats' command: The argument 'earliest(_time)' is invalid.

[cphair]

@singhg, are you on an earlier version of Splunk? It looks like the earliest function was introduced in 4.3. You can try last(_time) instead of earliest(_time), which looks at the time the event was indexed rather than the actual timestamp and so may be a bit less accurate.

[cphair]

For a known host foo:

index=main EventCode=4656 host=foo | stats earliest(_time) as Earliest | eval FirstSeen=strftime(Earliest,"%+") | table FirstSeen

To find the first time the event occurred on each host in the index:

index=main EventCode=4656 | stats earliest(_time) as Earliest by host | eval FirstSeen=strftime(Earliest,"%+") | table host,FirstSeen