jump to first event

[rstanonik]

A search returned 7000 events within one second.
By default splunk shows me the most recent events and allows me to next backward in time.
I want to see the first events.
How can I jump to the first events?
Thanks.

[BobM]

As far as I know, you can not tell splunk to start at the earliest time and work forward. The search sequence is hard coded but you can improve on the reverse command if you do not want later events.
The tail command will always show you the last x events in a list so this will show the last 3 (which equates to earliest as time is descending in our results.)

search | tail 3

This is marginally quicker as splunk just throws away earlier events rather than sort them.

[AlessandroMagno]

Hi,

can I insert a command faster than "search | reverse"?

I would known the date about the first event.

Thanks

[BobM]

if you add "| reverse" to the end of your search it will reverse the order and show you the oldest ones on the first page.