Splunk Search

What is the splunk search query to find oldest (first) event generated on an index?

Mayurmpatil
Path Finder

what is splunk search query to find the oldest ( first ) event generated on a index ?

0 Karma
1 Solution

FrankVl
Ultra Champion

index=bla | tail 1 would do the job, but unless you can pick a time window roughly around where you know the earliest event was, that is going to be horribly inefficient.

So you may first want to use a metadata or tstats search to figure out when the first event happened and then search for that specific point in time with tail 1 to find the actual event.

For example:

| tstats count where index=bla by _time | sort _time

or

| metadata type=sourcetypes where index=bla | convert ctime(firstTime)

View solution in original post

0 Karma

FrankVl
Ultra Champion

index=bla | tail 1 would do the job, but unless you can pick a time window roughly around where you know the earliest event was, that is going to be horribly inefficient.

So you may first want to use a metadata or tstats search to figure out when the first event happened and then search for that specific point in time with tail 1 to find the actual event.

For example:

| tstats count where index=bla by _time | sort _time

or

| metadata type=sourcetypes where index=bla | convert ctime(firstTime)
0 Karma

cyvi01
Path Finder
| tstats earliest(_time) AS _time WHERE index=bla


is enough

0 Karma

poete
Builder

Hello @Mayurmpatil,

index=<some_index>| stats latest(_raw) 

should do it

0 Karma

pradeepkumarg
Influencer

Shouldn't it be the reverse? first(_raw) ?

0 Karma

Mayurmpatil
Path Finder

index="bla" | stats last(_raw)

and
index="bla" | tail 1

both of them worked...

0 Karma

FrankVl
Ultra Champion

not first() but earliest(_raw). First doesn't use chronologic ordering, so may give unexpected result. Also: if you don't know over what timewindow to run this and therefor run it over all time, it will be very inefficient I guess.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...