first()

Table of Contents

Definition

first() returns the first seen value of the table column. You can use it with transform commands that support aggregations.

The first seen value of the column is the most recent event of this column. Events are not necessarily presented in a chronological order in the result.

Examples

You can use first() with timechart or other charting commands. The following query searches for first seen values in balance column and groups result by operation column.

%dpl
index=crud earliest=-3y
| spath
| timechart first(balance) by operation
example of first() function

Further Reading