earliest

Supported in:

Dashboards Rules Search

The earliest function returns the earliest timestamp from a set of records with microsecond resolution.

Syntax	Param data types	Return type
earliest(timestamp)	TIMESTAMP	TIMESTAMP

Code sample

• For all the events that match on hostname, store the earliest of metadata.event_timestamp in the start variable.

  $hostname = principal.hostname
  match:
    $hostname
  outcome:
    $start = earliest(metadata.event_timestamp)