earliest_time() & latest_time()

Table of Contents

Definition

earliest_time() returns the Unix time of the oldest occurrence of a value and latest_time() returns the most recent. Results are sorted in a chronological order.

You can use earliest_time() and latest_time() with transform commands that support aggregations.

Examples

Use earliest_time() and latest_time() with stats or other charting commands to return the Unix time of earliest and latest seen values.

%dpl
index=alert_examples earliest="01/01/2017:02:34:19"
| stats earliest_time(_raw), latest_time(_raw) by sourcetype
example of earliest_time and latest_time functions

Further Reading