What are the correct stats functions to use to get the first and last event for a host in a specified time range?

[splunker12er]

What is the correct stats function to use to get the last event for a host in a specified time range? first(_raw) or latest(_raw)?

Similarly, to get the first event for a host, what is the correct function to use? last(_raw) or earliest(_raw)?

Please advise..
Thanks..

[mdessus_splunk]

Does head and tail would match your needs ( mysearchcriteria host=xxx | head 1 for ex.) ?

[martin_mueller · Accepted solution]

If you're looking for the "most old" and "most young" events, use latest() and earliest().

If you're looking for "event zero" and "event n-1" from an ordered list of n events, use first() and last().