Splunk Search

Why are stats functions first() and latest() not returning the same result?

afieffe
Engager

Hello,

I am a little bit confused by the functions latest() and earliest().
Running this search:

index=myindex sourcetype=mysourcetype | stats first(myfield) latest(myfield) earliest(myfield) last(myfield) by sourcetype

Gives us

    first(myfield)      latest(myfield) earliest(myfield) last(myfield) 
    1434767753.755  1434767758.840  1383228859.223  1383228859.223

It is, from my point of view, normal to have the same value returned by earliest() and last(), as we did not change the order of the events. I am surprised to receive different values for first() and latest().

If we run:

index=myindex sourcetype=mysourcetype | head 1 | table myfield

We get:

myfield
1434767758.840

The value returned by latest() seems to be correct. What is returned by first()?

Regards

PS - We are running on Splunk Enterprise 6.2.3

Tags (3)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

first() gives you the value first seen by the reporting command, with no regard for the timestamp. Depending on what's returned first to the search head from the indexers this may or may not match with latest().

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...