earliest() & latest()

Table of Contents

Definition

earliest() returns the oldest and latest() returns the most recent seen occurrence of a value in the table column. Results are sorted in a chronological order.

You can use earliest() and latest() with transform commands that support aggregations.

Examples

Use earliest() and latest() with stats or other charting commands to search the earliest and latest seen values of selected table column.

%dpl
index=sales_inventory earliest="01/01/2017:02:34:19"
| stats earliest(_time), latest(_time) by sourcetype
example of earliest and latest functions

Further Reading