Dashboards & Visualizations

Display Minimum and Maximum values in a Column

NeonFlash
Explorer

I am querying a sourcetype which has a field called _time that displays the timestamp of the event. The format of this field is: 1/9/13 10:10:53.000 AM

Now, I want to display the minimum and maximum timestamps in the entire column.

I tried using the min and max functions however it does not give any output.

table min(_time), max(_time)

This way I would get the first instance and the last instance of the event from the logs.

I even tried to use the eval function as follows:

table eval(min(_time)), eval(max(_time))

Tags (3)

Suda
Communicator

I recommend you to use the following search commans after your searches.

(your search) 
| stats max(_time) AS max min(_time) AS min 
| eval max=strftime(max, "%Y/%m/%d %T.%3Q") 
| eval min=strftime(min, "%Y/%m/%d %T.%3Q")
| table min max

Thanks.

yannK
Splunk Employee
Splunk Employee

use stats, not table.

sdaniels
Splunk Employee
Splunk Employee

I think you may be looking for the commands head and tail.

| head 1 will give you the latest event and tail will give you the earliest for your specified time range.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/head
http://docs.splunk.com/Documentation/Splunk/5.0.1/SearchReference/Tail

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...