Is there a search command for Splunk that will find the oldest event in the index for a host faster than letting a full query run?
This should do the trick:
| metadata index=myindex type=hosts | search host="myhost" | fields + host, firstTime | convert ctime(firstTime)
how do we get the same by indexer? using splunk_server in by clause of stats wouldn't give the information.
The oldest event, or the time of the oldest event? The time is easy:
| metadata type=hosts | stats min(firstTime) as _time, values(host)
Once you have that, you could just take the time and search, or use a subsearch:
[ metadata type=hosts | stats min(firstTime) as _time, values(host) as host | mvexpand host ]
which will come back with all the events with that timestamp.
sorry, i guess the question was for a particular host, not any host. well.