Splunk Search

How to find earliest time a string appeared in a value?

mlaurabermudez
New Member

I have a field named "example", I want to find the first time that the first log that contained the word "hello".
How can I do this?

In other words, I have a field named "example" that contains several logs with text values. I want to obtain the time of the first log that contained the word "hello".

0 Karma

amitm05
Builder

@mlaurabermudez

You want to go something like -

index="SomeIndex" sourcetype="SomeSourceType" example="*hello*" | stats min(_time) as earliestTime values(example) as example latest(_raw) as RawEvent  | eval earliestTime=strftime(earliestTime,"%+")

And if you are saying that you need to do this for 2 different values in 2 different events, you would want to bring in the group by, Like

index="SomeIndex" sourcetype="SomeSourceType" example="hello1" OR example="*hello2*" | stats min(_time) as earliestTime latest(_raw) as RawEvent by example  | eval earliestTime=strftime(earliestTime,"%+")'

Please let me know if this answers your question! :grinning_face_with_smiling_eyes:
Thanks

kmorris_splunk
Splunk Employee
Splunk Employee

Does this give you what you are looking for:

index=YOURINDEX sourcetype=YOURSOURCETYPE example="*hello*" 
| stats earliest(_time) as earliest_time 
| eval earliest_time=strftime(earliest_time,"%m/%d/%Y %H:%M:%S")
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...