Splunk Search

What are the correct stats functions to use to get the first and last event for a host in a specified time range?

splunker12er
Motivator

What is the correct stats function to use to get the last event for a host in a specified time range? first(_raw) or latest(_raw)?

Similarly, to get the first event for a host, what is the correct function to use? last(_raw) or earliest(_raw)?

Please advise..
Thanks..

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

If you're looking for the "most old" and "most young" events, use latest() and earliest().

If you're looking for "event zero" and "event n-1" from an ordered list of n events, use first() and last().

View solution in original post

mdessus_splunk
Splunk Employee
Splunk Employee

Does head and tail would match your needs ( mysearchcriteria host=xxx | head 1 for ex.) ?

martin_mueller
SplunkTrust
SplunkTrust

If you're looking for the "most old" and "most young" events, use latest() and earliest().

If you're looking for "event zero" and "event n-1" from an ordered list of n events, use first() and last().

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!