Splunk Search

What is the splunk search query to find oldest (first) event generated on an index?

Mayurmpatil
Path Finder

what is splunk search query to find the oldest ( first ) event generated on a index ?

0 Karma
1 Solution

FrankVl
Ultra Champion

index=bla | tail 1 would do the job, but unless you can pick a time window roughly around where you know the earliest event was, that is going to be horribly inefficient.

So you may first want to use a metadata or tstats search to figure out when the first event happened and then search for that specific point in time with tail 1 to find the actual event.

For example:

| tstats count where index=bla by _time | sort _time

or

| metadata type=sourcetypes where index=bla | convert ctime(firstTime)

View solution in original post

0 Karma

FrankVl
Ultra Champion

index=bla | tail 1 would do the job, but unless you can pick a time window roughly around where you know the earliest event was, that is going to be horribly inefficient.

So you may first want to use a metadata or tstats search to figure out when the first event happened and then search for that specific point in time with tail 1 to find the actual event.

For example:

| tstats count where index=bla by _time | sort _time

or

| metadata type=sourcetypes where index=bla | convert ctime(firstTime)
0 Karma

poete
Builder

Hello @Mayurmpatil,

index=<some_index>| stats latest(_raw) 

should do it

0 Karma

pradeepkumarg
Influencer

Shouldn't it be the reverse? first(_raw) ?

0 Karma

Mayurmpatil
Path Finder

index="bla" | stats last(_raw)

and
index="bla" | tail 1

both of them worked...

0 Karma

FrankVl
Ultra Champion

not first() but earliest(_raw). First doesn't use chronologic ordering, so may give unexpected result. Also: if you don't know over what timewindow to run this and therefor run it over all time, it will be very inefficient I guess.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...