Splunk Search

Is there a search command for Splunk that will find the oldest event in the index for a host faster than letting a full query run?

Splunk Employee
Splunk Employee

Is there a search command for Splunk that will find the oldest event in the index for a host faster than letting a full query run?

Tags (3)

Super Champion

This should do the trick:

| metadata index=myindex type=hosts | search host="myhost" | fields + host, firstTime | convert ctime(firstTime)

Communicator

Any idea,
how do we get the same by indexer? using splunk_server in by clause of stats wouldn't give the information.

0 Karma

Splunk Employee
Splunk Employee

The oldest event, or the time of the oldest event? The time is easy:

| metadata type=hosts | stats min(firstTime) as _time, values(host)

Once you have that, you could just take the time and search, or use a subsearch:

[ metadata type=hosts | stats min(firstTime) as _time, values(host) as host | mvexpand host ]

which will come back with all the events with that timestamp.

Splunk Employee
Splunk Employee

sorry, i guess the question was for a particular host, not any host. well.

0 Karma