Identifies the event with the minimum value in a specified field and returns selected fields from that event.

The resulting event contains only the fields specified in the include parameter.

If multiple events share the same minimum value, the selectFromMin() function returns one event randomly.

ParameterTypeRequiredDefault ValueDescription
field[a]stringrequired   The name of the field that is used to find the minimum value.
includearray of stringsrequired   The names of the fields to include in the generated event.

[a] The parameter name field can be omitted.

Hide omitted argument names for this function

Show omitted argument names for this function

Find the first value of a field x (and when that value was from):

logscale
selectFromMin(@timestamp, include=[x, @timestamp])

This selects the event with minimum value of @timestamp that also contains the specified field x, and returns an event with fields @timestamp and x only.