What is the correct stats function to use to get the last event for a host in a specified time range? first(_raw)
or latest(_raw)
?
Similarly, to get the first event for a host, what is the correct function to use? last(_raw)
or earliest(_raw)
?
Please advise..
Thanks..
If you're looking for the "most old" and "most young" events, use latest()
and earliest()
.
If you're looking for "event zero" and "event n-1" from an ordered list of n events, use first()
and last()
.
Does head and tail would match your needs ( mysearchcriteria host=xxx | head 1 for ex.) ?
If you're looking for the "most old" and "most young" events, use latest()
and earliest()
.
If you're looking for "event zero" and "event n-1" from an ordered list of n events, use first()
and last()
.