First (first)

[ 1 Description ] [ 2 How does it work in the search window? ] [ 3 How does it work in LINQ? ]

Description

This returns the first value found in a specified column for each grouping occurrence. To determine the first value, Devo uses the eventdate time rather than the log time—this is when Devo receives it rather than when it was generated.

To exclude null values, use the First not null (nnfirst) operation.

How does it work in the search window?

You must group your data before performing this operation. Columns used as arguments for the grouping operation cannot be selected as arguments for the aggregation operation.

After grouping the data, select Aggregation in the search window toolbar and then select the First operation. You must specify one argument:

Argument	Data type

Argument	Data type
First of ^mandatory	Any

The data type of the aggregated values is the same as the data type of the column used as an argument.

You cannot repeat the First operation to apply subsequent aggregations. Use the Minimum (min) operation instead to get the same result. Repeating the First operation returns an error because it requires access to the eventdate field. However, this field isn't available for subsequent aggregations.

Example

In the siem.logtrust.web.activity table, we want to get the first Type value in each 5-minute period. Before aggregating the data, the table must be grouped in 5-minute intervals. Then we perform the aggregation using the First operation.

The arguments needed for the First operation are:

First of → Type column

Click on Aggregate function and you see the following result:

How does it work in LINQ?

Group your data using the following structure:

group every server period by column1, column2...
every client period

Then use select... as... to add the new column that shows the aggregated values. This is the syntax for the First operation:

first(column)

See Build a query using LINQ to learn more about grouping and aggregating your data using the LINQ language.

Example

Copy the following LINQ script and try the example above on thesiem.logtrust.web.activity table:

from siem.logtrust.web.activity
group every 5m
every 5m
  select count(type) as first_type