CODEWITHSUNDEEP
splunksplunk-querysplunk-calculation
saurabh choudhary
saurabh choudhary

Reputation: 93

How do I find first occurence of a particular event for the list of users in splunk

I have to find the first occurrence of a particular event for the list of users in splunk.

eg: I have a list of users say 10 from another query.

I am using the below query to find date of the first mail sent by customer 12345. How do I find the same for a list of customer that I get from another query?

index=abc appname=xyz "12345" "*\"SENT\"}}"|reverse|table _time|head 1

Upvotes: 0

Views: 1608

Answers (1)

RichG
RichG

Reputation: 9926

Try using stats.

index=abc appname=xyz "12345" "*\"SENT\"}}" | stats first(_time)

Upvotes: 0

Related Questions