Description

Returns the first seen value in a field. The first seen value of the field is the most recent instance of this field, based on the order in which the events are seen by the stats command. The order in which the events are seen is not necessarily chronological order.

Usage

You can use this function with the chart, stats, and timechart commands.

• To locate the first value based on time order, use the earliest function instead.
• This function works best when the search includes the sort command immediately before the statistics or charting command.
• This function processes field values as strings.

Basic example

You run the following search to locate invalid user login attempts against a specific sshd (Secure Shell Daemon). You use the table command to see the values in the _time, source, and _raw fields.

sourcetype=secure invalid user "sshd[5258]" | table _time source _raw

The results look like this:

You extend the search using the first function.

sourcetype=secure invalid user "sshd[5258]" | table _time source _raw | stats first(_raw)

The search returns the value for _raw field with the timestamp 2020-04-28 00:15:05, which is the first event in the original list of values returned.

Extended example

The Basic example uses the _raw field to show how the first function works. That's useful because the _raw field contains a timestamp. However, you can use the first function on any field.

Let's start by creating some results. You can use the makeresults command to create a series of results to test your search syntax. Include the streamstats command to count your results:

| makeresults count=5 
| streamstats count

The results look like this:

With the count field, you can create different dates in the _time field, using the eval command.

| makeresults count=5 
| streamstats count
| eval _time=_time-(count*3600)

Use 3600, the number of seconds in an hour, to create a series of hours. The calculation multiplies the value in the count field by the number of seconds in an hour. The result is subtracted from the original _time field to get new dates equivalent to 1 hours ago, 2 hours ago, and so forth.

The results look like this:

The hours in the results begin with the 1 hour earlier than the original date, 2020-05-09 at 14:24. The minutes and seconds are slightly different because the date is refreshed each time you run the search.

Use the eval command to add a field to your search with values in descending order:

| makeresults count=5 
| streamstats count
| eval _time=_time-(count*3600)
| eval field1=20-count

The results look like this:

As you can see from the results, the first result contains the highest number in field1. This shows the order in which the results were processed. The first result was processed first (20-1=19) followed by the remaining results in order.

When you add the first function to the search, the only value returned is the value in the field you specify:

| makeresults count=5 
| streamstats count
| eval _time=_time-(count*3600)
| eval field1=20-count
| stats first(field1)

The results look like this:

Description

Returns the last seen value in a field. The last seen value of the field is the oldest instance of this field, based on the order in which the events are seen by the stats command. The order in which the events are seen is not necessarily chronological order.

Usage

You can use this function with the chart, stats, and timechart commands.

• To locate the last value based on time order, use the latest function instead.
• This function works best when the search includes the sort command immediately before the statistics or charting command.
• This function processes field values as strings.

Basic example

The following example returns the first "log_level" value for each distinct "sourcetype".

You run the following search to locate invalid user login attempts against a specific sshd (Secure Shell Daemon). You use the table command to see the values in the _time, source, and _raw fields.

sourcetype=secure invalid user "sshd[5258]" | table _time source _raw

The results appear on the Statistics tab and look like this:

You extend the search using the last function.

sourcetype=secure invalid user "sshd[5258]" | table _time source _raw | stats last(_raw)

The search returns the event with the _time value 2020-04-27 00:15:01, which is the last event in the list of events. However it is not the last chronological event.

Extended example

The Basic example uses the _raw field to show how the last function works. That's useful because the _raw field contains a timestamp. However, you can use the last function on any field.

Let's start by creating some results. You can use the makeresults command to create a series of results to test your search syntax. Include the streamstats command to count your results:

| makeresults count=5 
| streamstats count

The results look like this:

With the count field, you can create different dates in the _time field, using the eval command.

| makeresults count=5 
| streamstats count
| eval _time=_time-(count*86400)

Use 86400, the number of seconds in a day, to create a series of days. The calculation multiplies the value in the count field by the number of seconds in an day. The result is subtracted from the original _time field to get new dates equivalent to 1 day ago, 2 days ago, and so forth.

The results look like this:

The dates in the results begin with the 1 day earlier than the original date, 2020-05-09 at 14:45:24. The minutes and seconds are slightly different because the date is refreshed each time you run the search.

Use the eval command to add a field to your search with values in descending order:

| makeresults count=5 
| streamstats count
| eval _time=_time-(count*86400)
| eval field1=20-count

The results look like this:

As you can see from the results, the last result contains the lowest number in field1. This shows the order in which the results were processed. The fifth result was processed last (20-5=15) after all of the other results.

When you add the last function to the search, the only value returned is the value in the field you specify:

| makeresults count=5 
| streamstats count
| eval _time=_time-(count*86400)
| eval field1=20-count
| stats last(field1)

The results look like this: