Splunk Search

What is the difference between min() max() and earliest() latest() for _time manipulations?

edefIo1937
Engager

If i only want to use the field "_time" of a log to get first and latest occurrence of an event, which commands should i use and why ? 

ex:
...
| stats earliest(_time) as firsttime latest(_time) as lasttime 

...

or
... 

| stats min(_time) as firsttime max(_time) as lasttime

...

 

Is there a case where i could get differents results ?

Labels (3)

jordan_art
Engager

what does Splunk recommend ?

 
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jordan_art,

there isn't a best practice, you can use both of them with the same results.

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @edefIo1937,

_time is a timestamp in epochtime format, in other words a progressive number, so it's the same thing.

I usually use earliest and latest.

Ciao.

Giuseppe

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Whereas there is no numeric difference, I am also curious as to which one is faster.  I usually go with min/max with the following reasoning:

  • min/max are purely mathematical after all values become available.
  • earliest(_time)/latest(_time), on the other hand, require two operations, one to compare time stamps on events, one to return value of _time.

The second argument, of course, is flawed.  It should depend on implementation of index and search.  Any Splunk insider to shed light on this?

Get Updates on the Splunk Community!

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...