first(expression: storable, [order_by(...)]?) -> expression

first returns the value of its expression from the chronologically or otherwise first row in each aggregation group according to the ordering that applies to that aggregation. In plain aggregate context you may pass an optional second argument of ordering type to control which row is first; if you omit it, ordering follows the verb-level ordering, which is usually ascending valid-from on the input dataset. In windowed form the call must appear inside window; a second ordering argument is not allowed there and ordering must be supplied on window itself. Null values are kept as ordinary values, so the first row can be null if that is what ordering selects.

Domain

This is an aggregate function (aggregates rows over a group in aggregate verbs).

This is a window function (calculates over a group of multiple input rows using windowing).

Categories

• Aggregate
• Window

Examples

aggregate first_status:first(status, order_by(valid_from)), group_by(host)

Picks the status from the earliest row per host using explicit valid_from ordering in an aggregate.

make_col first_err:window(first(error_code), group_by(host), order_by(valid_from), frame(back:15m))

Returns the first error_code in each host partition inside a fifteen-minute trailing frame via window.