What is the best was to identify the outage window in one search?

[dolj]

is there a best practice search to find the last event sent at the start of an outage and the first event the come in after the outage for a specific data source was rectified? Basically what is the best was to identify the outage window in one search?

[gcusello]

Hi @dolj,

if you want to find the time borders of a search you can use "addinfo" (https://docs.splunk.com/Documentation/Splunk/8.2.6/SearchReference/Addinfo).

If instead you want to display the first and the last event, you can use stats and the options "first" and "last", something like this:

your_search
| stats first(_raw) AS first last(_raw) AS last 

Ciao.

Giuseppe