Splunk Search

Find earliest events by category

Jordan_Brough
Path Finder

I'd like to select the earliest events broken down by category.

i.e. I would like to see something like this:

error | stats earliest(_raw) as earliest_raw by error_category | ...

That pretty much gives me what I need, but it's a little inconvenient that 1) now I have to work off of "earliest_raw" and 2) the event list view doesn't show anything.

Is there a better way? What I'd really like to do is something like:

error | earliest by error_category | ...
Tags (2)
0 Karma
1 Solution

Jordan_Brough
Path Finder

aholzer's answer worked great:

error | dedup category sortby +_time | ...

Thanks!

View solution in original post

0 Karma

Jordan_Brough
Path Finder

aholzer's answer worked great:

error | dedup category sortby +_time | ...

Thanks!

0 Karma

Jordan_Brough
Path Finder

I'm not sure how to use head/tail since I also need to group by category, but dedup:

dedup category sortby +_time

worked like a charm! Thanks!

0 Karma

aholzer
Motivator

You may want to consider using one of the following:
- dedup with a sort by time
error | dedup error_category sort by +_time
- the head command or the tail command depending how you want to look at your events

Just remember that you can perform checks on the field "_time" to get the earliest

Hope this helps

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...