Splunk Search

How to find the timestamp of first occurrence of the event in a transaction?

Path Finder

I have a transaction similar to the below one:

02/06/2018 15:10:30.560 Starting transaction
02/06/2018 15:20:90.150 Message A
02/06/2018 15:21:33.480 Message B
02/06/2018 15:23:57.442 Message B
02/06/2018 15:24:12.772 Message B

I need to find the timestamp of the first occurrence of the message B event i.e., 02/06/2018 15:21:33.480 in the above example. I cannot use endswith=Message B, as I also need the events that happened after it.

Appreciate for the suggestions.

0 Karma


Extract 'A, 'B' on to a field , say msg_name using rex/props.conf.

Then you can run

your search | eventstats earliest(time) AS earliest by msgname should tell you time for each message.


0 Karma



you can use rex command to do field extraction at search time and extract the timestamp of event B.

0 Karma