topic Re: index start date in Getting Data In

index start date

sushil_borah — Fri, 27 Apr 2012 17:48:48 GMT

I need to generate a daily report in splunk with the list of all the indexes and their earliest event(timestamp) and their latest(timestamp). Is there a way to do it? I have the below queries.

For the start and end time:

| metadata type=sourcetypes index=XXX | stats min(firstTime) AS begin max(lastTime) AS end

For the list of indexes:

| eventcount summarize=false index=* dedup=index | top 0 index | fields index

Re: index start date

araitz — Fri, 27 Apr 2012 18:37:25 GMT

Schedule this to run daily:

| rest /services/data/indexes 
| search totalEventCount > 0 
| eval now=strftime(now(), "%Y-%m-%d")
| stats first(maxTime) as maxTime first(minTime) as minTime first(now) as now first(currentDBSizeMB) as currentDBSizeMB by title

Re: index start date

sushil_borah — Fri, 27 Apr 2012 21:13:30 GMT

thanks thats exactly what i needed

Re: index start date

araitz — Fri, 27 Apr 2012 23:57:04 GMT

That's why I am here 🙂

Re: index start date

sushil_borah — Tue, 22 May 2012 20:46:46 GMT

is it possible to add the index volume to the above genertated report?

Re: index start date

araitz — Tue, 22 May 2012 21:05:17 GMT

see my update above.

Re: index start date

sushil_borah — Tue, 22 May 2012 21:17:26 GMT

does currentDBSizeMB lists the total index volume?

Re: index start date

araitz — Tue, 22 May 2012 21:21:06 GMT

It is the total size of the index in MB at the time that the search was run.

Re: index start date

andygerber — Fri, 27 Oct 2017 21:03:39 GMT

Awesome answer. For me this refinement was helpful.

 | rest /services/data/indexes 
 | search totalEventCount > 0 
 | eval now=strftime(now(), "%Y-%m-%d")
 | stats first(maxTime) as "Earliest Event Time" first(minTime) as "Latest Event Time" first(now) as "Current Date" first(currentDBSizeMB) as currentDBSizeMB by title 
 | rename title as "Index" | sort - currentDBSizeMB
 | eval "Index Size in GB"= round(currentDBSizeMB/1000,2)
 | table Index "Earliest Event Time" "Latest Event Time" "Current Date" "Index Size in GB"

Re: index start date

myacoub — Mon, 21 Jan 2019 11:39:09 GMT

Hello Andygerber,

I just believe you switched the Earliest with the latest in your search , Am i right ?

Thanks

Re: index start date

andygerberkp — Mon, 21 Jan 2019 15:10:32 GMT

Yes, I believe so... using a different account, or I would edit it. Corrected below:

 | rest /services/data/indexes 
  | search totalEventCount > 0 
  | eval now=strftime(now(), "%Y-%m-%d")
  | stats first(minTime) as "Earliest Event Time" first(maxTime) as "Latest Event Time" first(now) as "Current Date" first(currentDBSizeMB) as currentDBSizeMB by title 
  | rename title as "Index" | sort - currentDBSizeMB
  | eval "Index Size in GB"= round(currentDBSizeMB/1000,2)
  | table Index "Earliest Event Time" "Latest Event Time" "Current Date" "Index Size in GB"