Splunk Search

How to find earliest time a string appeared in a value?

mlaurabermudez
New Member

I have a field named "example", I want to find the first time that the first log that contained the word "hello".
How can I do this?

In other words, I have a field named "example" that contains several logs with text values. I want to obtain the time of the first log that contained the word "hello".

0 Karma

amitm05
Builder

@mlaurabermudez

You want to go something like -

index="SomeIndex" sourcetype="SomeSourceType" example="*hello*" | stats min(_time) as earliestTime values(example) as example latest(_raw) as RawEvent  | eval earliestTime=strftime(earliestTime,"%+")

And if you are saying that you need to do this for 2 different values in 2 different events, you would want to bring in the group by, Like

index="SomeIndex" sourcetype="SomeSourceType" example="hello1" OR example="*hello2*" | stats min(_time) as earliestTime latest(_raw) as RawEvent by example  | eval earliestTime=strftime(earliestTime,"%+")'

Please let me know if this answers your question! 😄
Thanks

kmorris_splunk
Splunk Employee
Splunk Employee

Does this give you what you are looking for:

index=YOURINDEX sourcetype=YOURSOURCETYPE example="*hello*" 
| stats earliest(_time) as earliest_time 
| eval earliest_time=strftime(earliest_time,"%m/%d/%Y %H:%M:%S")
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...