min

The min aggregation function finds the minimum value across the group.

Use this function with the summarize, eventstats, and timestats operators.

Syntax

​

    min( Expression )

Arguments

​

• Expression: Expression used for aggregation calculation. Wildcards are not supported for field names.

Results

​

Returns the minimum value of Expression across the group.

Numeric values are considered before alpha or alphanumeric values.

Example

​

This example summarizes the minimum traffic, in bytes, for each source port:

dataset="cribl_search_sample" 
| limit 1000 
| summarize min(bytes) by srcport