I am querying a sourcetype which has a field called _time that displays the timestamp of the event. The format of this field is: 1/9/13 10:10:53.000 AM
Now, I want to display the minimum and maximum timestamps in the entire column.
I tried using the min and max functions however it does not give any output.
table min(_time), max(_time)
This way I would get the first instance and the last instance of the event from the logs.
I even tried to use the eval function as follows:
table eval(min(_time)), eval(max(_time))
I recommend you to use the following search commans after your searches.
(your search)
| stats max(_time) AS max min(_time) AS min
| eval max=strftime(max, "%Y/%m/%d %T.%3Q")
| eval min=strftime(min, "%Y/%m/%d %T.%3Q")
| table min max
Thanks.
use stats, not table.
I think you may be looking for the commands head and tail.
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/head
http://docs.splunk.com/Documentation/Splunk/5.0.1/SearchReference/Tail