Splunk Search

Is there a search command for Splunk that will find the oldest event in the index for a host faster than letting a full query run?

esweeney
Splunk Employee
Splunk Employee

Is there a search command for Splunk that will find the oldest event in the index for a host faster than letting a full query run?

Tags (3)

Lowell
Super Champion

This should do the trick:

| metadata index=myindex type=hosts | search host="myhost" | fields + host, firstTime | convert ctime(firstTime)

newbie2tech
Communicator

Any idea,
how do we get the same by indexer? using splunk_server in by clause of stats wouldn't give the information.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

The oldest event, or the time of the oldest event? The time is easy:

| metadata type=hosts | stats min(firstTime) as _time, values(host)

Once you have that, you could just take the time and search, or use a subsearch:

[ metadata type=hosts | stats min(firstTime) as _time, values(host) as host | mvexpand host ]

which will come back with all the events with that timestamp.

gkanapathy
Splunk Employee
Splunk Employee

sorry, i guess the question was for a particular host, not any host. well.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...