You could just create one event instead of three, or in the example, just return the first event: | head 1 If you're working with ISO time strings but unknown times in an unknown order, you can sort lexicographically: | sort time_1 | head 1 If the time format is known but not necessarily in ISO format, you can convert time_1 to an epoch value using the appropriate format string (still ISO in this example) and sort the result: | eval time_1_epoch=strptime(time_1, "%Y-%m-%dT%H:%M:%S%Z") | sort time_1_epoch | head 1 If multiple events have the same time_1 value, you can use eventstats and where: | eval time_1_epoch=strptime(time_1, "%Y-%m-%dT%H:%M:%S%Z") | eventstats min(time_1_epoch) as min_time_1 | where time_1_epoch==min_time_1