Hi all,
is there a quick way to find the earliest event (given the logtype and the index) matching a query ?
Or, if you are looking for a more generic solution:
yoursearchhere
| tail 1
Why tail
and not head
? Because Splunk returns the search results sorted so that the latest result comes first. So the last result will be the earliest.
Other variations are possible. For example, if I want to see the earliest time that each clientip address appeared in the results, along with the count:
yoursearchhere
| stats earliest(_time) as FirstAppearance count by clientip
| fieldformat FirstAppearance=strftime(FirstAppearance,"%x %X")
Cool! Thank you!
If you by 'logtype' mean sourcetype
;
| metadata type=sourcetypes index=your_indexname_here | convert ctime(firstTime) | fields - lastTime, recentTime, type
and yes, the search starts with a pipe (|)
/K