Using earliest with custom time field

[agh]

This below query gives me the earliest trigger_name according to the splunk log timestamps. But I have a custom timestamp field called TIMESTAMP_DERIVED which does not match the _time and I want to do my earliest calculation based on that field. Is this possible?

eventtype=sfdc-event-log | stats earliest(TRIGGER_NAME), earliest(TRIGGER_TYPE) by REQUEST_ID 

[bowesmana · Accepted solution]

If you convert the TIMESTAMP_DERIVED to _time then you can do what you are doing, but that will depend on if you still need _time to be present.

Note that the data you search for will only appear in your results if _time is within the time range selected, so even if TIMESTAMP_DERIVED is a time within your search window it will not be found

You can convert TIMESTAMP_DERIVED with

| eval _time=strptime(TIMESTAMP_DERIVED, "_format_specifiers_here")