findfirst ​

The findfirst aggregation function returns the first observed non-null value of Expression across the group.

Use this function with the summarize, eventstats, and timestats operators.

Syntax ​

findfirst( Expression )

Arguments ​

• Expression: Expression used for aggregation calculation. Wildcards are not supported for field names.

Usage ​

To find an earliest event with respect to the _time field, instead use findearliest.

When events are sorted with sort or order, findfirst returns the first non-null value of Expression in that sort order.

When events are not sorted, findfirst behaves like take_any and returns an arbitrary non-null value. Use take_any when sort order does not matter.

Examples ​

Here is a basic example:

dataset=myDataset
| summarize findfirst(channel)

This example effectively finds min(status) and max(status):

dataset="cribl_internal_logs" status=/[0-9]+/ 
| order by status asc 
| summarize x = findfirst(status), y = findlast(status)