How to find the timestamp of first occurrence of the event in a transaction?

[Naren26]

I have a transaction similar to the below one:

02/06/2018 15:10:30.560 Starting transaction
02/06/2018 15:20:90.150 Message A
02/06/2018 15:21:33.480 Message B
02/06/2018 15:23:57.442 Message B
02/06/2018 15:24:12.772 Message B

I need to find the timestamp of the first occurrence of the message B event i.e., 02/06/2018 15:21:33.480 in the above example. I cannot use endswith=Message B, as I also need the events that happened after it.

Appreciate for the suggestions.

[lakshman239]

Extract 'A, 'B' on to a field , say msg_name using rex/props.conf.

Then you can run

your search | eventstats earliest(_time) AS earliest by msg_name should tell you time for each message.

https://docs.splunk.com/Documentation/Splunk/7.2.3/SearchReference/Eventstats

[vishaltaneja070]

@Naren26

you can use rex command to do field extraction at search time and extract the timestamp of event B.