https://community.splunk.com/t5/Getting-Data-In/How-can-I-get-oldest-event-per-host-from-metadata/m-p/192609#M38398 <P>Hi a212830,</P> <P>from the docs <A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Metadata">http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Metadata</A></P> <PRE><CODE>firstTime is the timestamp for the first time that the indexer saw an event from this host. </CODE></PRE> <P>Does this not do the job for you? For me it works:</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/137i38240B663A172E68/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Mon, 03 Nov 2014 06:44:14 GMT MuS 2014-11-03T06:44:14Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-get-oldest-event-per-host-from-metadata/m-p/192608#M38397 <P>Hi,</P> <P>Is there a way to get the oldest event dates for certain hosts using metadata? </P> Mon, 03 Nov 2014 02:28:10 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-get-oldest-event-per-host-from-metadata/m-p/192608#M38397 a212830 2014-11-03T02:28:10Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-get-oldest-event-per-host-from-metadata/m-p/192609#M38398 <P>Hi a212830,</P> <P>from the docs <A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Metadata">http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Metadata</A></P> <PRE><CODE>firstTime is the timestamp for the first time that the indexer saw an event from this host. </CODE></PRE> <P>Does this not do the job for you? For me it works:</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/137i38240B663A172E68/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Mon, 03 Nov 2014 06:44:14 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-get-oldest-event-per-host-from-metadata/m-p/192609#M38398 MuS 2014-11-03T06:44:14Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-get-oldest-event-per-host-from-metadata/m-p/192610#M38399 <P>Sorry - actually needs to include host, index and sourcetype. I get a lot of data for these hosts, so using metadata would be a hug help. We are concerned that data is dropping. </P> Tue, 04 Nov 2014 20:37:48 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-get-oldest-event-per-host-from-metadata/m-p/192610#M38399 a212830 2014-11-04T20:37:48Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-get-oldest-event-per-host-from-metadata/m-p/192611#M38400 <P>The metadata command doesn't provide you mapping of index/sourcetype and host at once. Try following (will take more time but may be the only option)</P> <PRE><CODE>| metasearch index=* sourcetype=* host=* | stats min(_time) as firstTime by index sourcetype host </CODE></PRE> Tue, 04 Nov 2014 21:37:24 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-get-oldest-event-per-host-from-metadata/m-p/192611#M38400 somesoni2 2014-11-04T21:37:24Z