Splunk Search

How to find earliest time a string appeared in a value?

mlaurabermudez
New Member

I have a field named "example", I want to find the first time that the first log that contained the word "hello".
How can I do this?

In other words, I have a field named "example" that contains several logs with text values. I want to obtain the time of the first log that contained the word "hello".

0 Karma

amitm05
Builder

@mlaurabermudez

You want to go something like -

index="SomeIndex" sourcetype="SomeSourceType" example="*hello*" | stats min(_time) as earliestTime values(example) as example latest(_raw) as RawEvent  | eval earliestTime=strftime(earliestTime,"%+")

And if you are saying that you need to do this for 2 different values in 2 different events, you would want to bring in the group by, Like

index="SomeIndex" sourcetype="SomeSourceType" example="hello1" OR example="*hello2*" | stats min(_time) as earliestTime latest(_raw) as RawEvent by example  | eval earliestTime=strftime(earliestTime,"%+")'

Please let me know if this answers your question! 😄
Thanks

kmorris_splunk
Splunk Employee
Splunk Employee

Does this give you what you are looking for:

index=YOURINDEX sourcetype=YOURSOURCETYPE example="*hello*" 
| stats earliest(_time) as earliest_time 
| eval earliest_time=strftime(earliest_time,"%m/%d/%Y %H:%M:%S")
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...