Splunk Search

What is the difference between min() max() and earliest() latest() for _time manipulations?

edefIo1937
Engager

If i only want to use the field "_time" of a log to get first and latest occurrence of an event, which commands should i use and why ? 

ex:
...
| stats earliest(_time) as firsttime latest(_time) as lasttime 

...

or
... 

| stats min(_time) as firsttime max(_time) as lasttime

...

 

Is there a case where i could get differents results ?

Labels (3)

jordan_art
Engager

what does Splunk recommend ?

 
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jordan_art,

there isn't a best practice, you can use both of them with the same results.

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @edefIo1937,

_time is a timestamp in epochtime format, in other words a progressive number, so it's the same thing.

I usually use earliest and latest.

Ciao.

Giuseppe

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Whereas there is no numeric difference, I am also curious as to which one is faster.  I usually go with min/max with the following reasoning:

  • min/max are purely mathematical after all values become available.
  • earliest(_time)/latest(_time), on the other hand, require two operations, one to compare time stamps on events, one to return value of _time.

The second argument, of course, is flawed.  It should depend on implementation of index and search.  Any Splunk insider to shed light on this?

Get Updates on the Splunk Community!

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...

Splunk With AppDynamics - Meet the New IT (And Engineering) Couple

Wednesday, November 20, 2024  |  10AM PT / 1PM ET Register Now Join us in this session to learn all about ...

Building a Self-Service and Scalable Observability Practice

Thursday, November 14, 2024  |  11AM PT / 2PM ET Register Now Join us in this session and learn how Splunk ...