Splunk Search

What is the splunk search query to find oldest (first) event generated on an index?

Mayurmpatil
Path Finder

what is splunk search query to find the oldest ( first ) event generated on a index ?

0 Karma
1 Solution

FrankVl
Ultra Champion

index=bla | tail 1 would do the job, but unless you can pick a time window roughly around where you know the earliest event was, that is going to be horribly inefficient.

So you may first want to use a metadata or tstats search to figure out when the first event happened and then search for that specific point in time with tail 1 to find the actual event.

For example:

| tstats count where index=bla by _time | sort _time

or

| metadata type=sourcetypes where index=bla | convert ctime(firstTime)

View solution in original post

0 Karma

FrankVl
Ultra Champion

index=bla | tail 1 would do the job, but unless you can pick a time window roughly around where you know the earliest event was, that is going to be horribly inefficient.

So you may first want to use a metadata or tstats search to figure out when the first event happened and then search for that specific point in time with tail 1 to find the actual event.

For example:

| tstats count where index=bla by _time | sort _time

or

| metadata type=sourcetypes where index=bla | convert ctime(firstTime)
0 Karma

cyvi01
Path Finder
| tstats earliest(_time) AS _time WHERE index=bla


is enough

0 Karma

poete
Builder

Hello @Mayurmpatil,

index=<some_index>| stats latest(_raw) 

should do it

0 Karma

pradeepkumarg
Influencer

Shouldn't it be the reverse? first(_raw) ?

0 Karma

Mayurmpatil
Path Finder

index="bla" | stats last(_raw)

and
index="bla" | tail 1

both of them worked...

0 Karma

FrankVl
Ultra Champion

not first() but earliest(_raw). First doesn't use chronologic ordering, so may give unexpected result. Also: if you don't know over what timewindow to run this and therefor run it over all time, it will be very inefficient I guess.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...