This below query gives me the earliest trigger_name according to the splunk log timestamps. But I have a custom timestamp field called TIMESTAMP_DERIVED which does not match the _time and I want to do my earliest calculation based on that field. Is this possible?
eventtype=sfdc-event-log | stats earliest(TRIGGER_NAME), earliest(TRIGGER_TYPE) by REQUEST_ID
If you convert the TIMESTAMP_DERIVED to _time then you can do what you are doing, but that will depend on if you still need _time to be present.
Note that the data you search for will only appear in your results if _time is within the time range selected, so even if TIMESTAMP_DERIVED is a time within your search window it will not be found
You can convert TIMESTAMP_DERIVED with
| eval _time=strptime(TIMESTAMP_DERIVED, "_format_specifiers_here")
If you convert the TIMESTAMP_DERIVED to _time then you can do what you are doing, but that will depend on if you still need _time to be present.
Note that the data you search for will only appear in your results if _time is within the time range selected, so even if TIMESTAMP_DERIVED is a time within your search window it will not be found
You can convert TIMESTAMP_DERIVED with
| eval _time=strptime(TIMESTAMP_DERIVED, "_format_specifiers_here")