Splunk Search

First & Last Occurrence of a Field

colinmchugo
Explorer

Hi,

Is there a way of discovering when an a field (e.g. like an IP address or MAC address) was first seen in the index? So i can pull out the data for the last time it was seen (which would be the default) but id also like to see when this was first seen and pull the time stamp and other data if possible?

thanks in advance

C.

0 Karma

rjthibod
Champion

If you want the most accurate (in terms of timestamp, not indexing-time), then you should use min(_time). For example, use this query where you swap out the values for your base search and field name.

<YOUR_BASE_SEARCH> <YOUR_FIELD>=* | stats min(_time) as earliest by <YOUR_FIELD>

A faster way that relies on indexing-time, not the raw timestamp, is using earliest(_time).

<YOUR_BASE_SEARCH> <YOUR_FIELD>=* | stats earliest(_time) as earliest by <YOUR_FIELD>

Usually these two will return the same values, but that is not guaranteed, e.g., events get stuck in a queue and get indexed some time later.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk Life | Splunk is Officially Part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint. Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...