min

The min function returns the minimum of the values within a numeric column. It is often used with match to get the minimum value within each group in the data.

Syntax	Param data types	Return type
min(numericExpression)	NUMBER	NUMBER

Code Sample

• Find all the events where target.ip is not empty. For all the events that match on principal.ip, store the minimum of metadata.event_timestamp.seconds in a variable called min_seconds.

  target.ip != ""
  match:
    principal.ip
  outcome:
    $min_seconds = min(metadata.event_timestamp.seconds)