Using stats and table command

[Vig95]

Hi,

I am new to splunk, could you please help me with below SPL, I am trying to use stats and table command

We have 4 entries for same incident, I need to pick earliest time.

Index="monitoring" sourcetype="tool" incident_id=INC* | stats earliest(_time) as early | table "mc_host" "incident_id" "early" | convert ctime(early)

I am getting error if execute.

[gcusello · Accepted solution]

Hi @Vig95,

the solution is the one hinted by @isoutamo because after a stats command you have only the fields used in the stats command itself, so you have to declare (using e.g. values or earliest) all the fields you need in the following table, that couldn't be necessary if the fields from the stats command are already in the order you want:

index="monitoring" sourcetype="tool" incident_id=INC* 
| stats earliest(_time) as early BY mc_host incident_id
| convert ctime(early)

Ciao.

giuseppe

[gcusello]

Hi @Vig95 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[isoutamo]

Hi

you probably want to see it by inc? If so you could try

Index="monitoring" sourcetype="tool" incident_id=INC* 
| stats min(_time) as _time values(mc_host) as mc_host by incident_id
| table "mc_host" "incident_id" _time

r. Ismo