Splunk Search

What are the correct stats functions to use to get the first and last event for a host in a specified time range?

splunker12er
Motivator

What is the correct stats function to use to get the last event for a host in a specified time range? first(_raw) or latest(_raw)?

Similarly, to get the first event for a host, what is the correct function to use? last(_raw) or earliest(_raw)?

Please advise..
Thanks..

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

If you're looking for the "most old" and "most young" events, use latest() and earliest().

If you're looking for "event zero" and "event n-1" from an ordered list of n events, use first() and last().

View solution in original post

mdessus_splunk
Splunk Employee
Splunk Employee

Does head and tail would match your needs ( mysearchcriteria host=xxx | head 1 for ex.) ?

martin_mueller
SplunkTrust
SplunkTrust

If you're looking for the "most old" and "most young" events, use latest() and earliest().

If you're looking for "event zero" and "event n-1" from an ordered list of n events, use first() and last().

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...