To get the 'top' number of events, the sort() has a limit parameter to limit the output; with the addition of the order parameter this can be used to sort and order from the highest to the lowest or vice versa. For example, with this input event set (from a groupBy()):

The top 5 (by count):

groupby(host)
| sort(_count,order=desc,limit=5)

Produces

The bottom 5 (by count):

groupby(host)
| sort(_count,order=asc,limit=5)

If the dataset is large, a quicker approximate value can be obtained using top().

To get the same information ordered by the timestamp data, use the tail() and head() functions. These return the last or first events according to the timestamp.

For example, to get the latest event:

host = "DEV-DB01"
| tail(1)

Might return:

Alternative, if you are looking for only one value, use the selectFromMin() or selectFromMax() functions and add @database as one of the selected values:

selectFromMin(@timestamp, include=[#hostname, @timestamp])

Gets the oldest value.