Splunk Search

Is there a search command for Splunk that will find the oldest event in the index for a host faster than letting a full query run?

esweeney
Splunk Employee
Splunk Employee

Is there a search command for Splunk that will find the oldest event in the index for a host faster than letting a full query run?

Tags (3)

Lowell
Super Champion

This should do the trick:

| metadata index=myindex type=hosts | search host="myhost" | fields + host, firstTime | convert ctime(firstTime)

newbie2tech
Communicator

Any idea,
how do we get the same by indexer? using splunk_server in by clause of stats wouldn't give the information.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

The oldest event, or the time of the oldest event? The time is easy:

| metadata type=hosts | stats min(firstTime) as _time, values(host)

Once you have that, you could just take the time and search, or use a subsearch:

[ metadata type=hosts | stats min(firstTime) as _time, values(host) as host | mvexpand host ]

which will come back with all the events with that timestamp.

gkanapathy
Splunk Employee
Splunk Employee

sorry, i guess the question was for a particular host, not any host. well.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...