topic Re: How can i list logs files indexed by indexing date? in Getting Data In

How can i list logs files indexed by indexing date?

chlima — Thu, 15 Jan 2015 19:00:17 GMT

Hi guys!

I have a folder monitoring stanza (E.g: "C:|logs|client|") and I want list all indexed files from these directory by indexing datetime. How can I do it?

Thanks!

Re: How can i list logs files indexed by indexing date?

chanfoli — Thu, 15 Jan 2015 19:08:20 GMT

Since you will likely have an indexed time for every event in the log, you are probably going to want to be a little more specific to summarize this data. Here is something to get you started which will give you the latest index time of an event for each source in your selected time range:

source=* | eval indexed_time=strftime(_indextime, "%+") | stats max(indexed_time) by source

Re: How can i list logs files indexed by indexing date?

chlima — Thu, 15 Jan 2015 20:02:34 GMT

It's works!

I made a little change in the query removing the clausule "by source":

source=* | eval indexed_time=strftime(_indextime, "%+") | stats max(indexed_time)

Thanks for the help!