https://community.splunk.com/t5/Splunk-Search/how-to-find-out-the-data-available-for-a-sourcetype/m-p/413561#M119180 <P>I'm assuming you want to know the retention period for your data, so here is my response. The retention period is setup at <CODE>index</CODE> level, not at <CODE>sourcetype</CODE> level. So what you need to do is find out which (or which all) index(es) your sourcetype is logging to and find the frozenTimePeriodInSecs attribute for that index (which defines the age of the bucket after it rolls to frozen).</P> <P>Query to find index name:</P> <PRE><CODE>| tstats count WHERE index=* sourcetype=YourSourceTypeHere by index </CODE></PRE> <P>Above will give you one row for each index that sourcetype logs data to. Then for each such index, run following query to find the retention period.</P> <PRE><CODE>| rest /services/data/indexes/indexNameHereFromAboveSearch | stats values(frozenTimePeriodInSecs) as frozenTimePeriodInSecs | eval Age=tostring(frozenTimePeriodInSecs,"duration") </CODE></PRE> Mon, 21 May 2018 18:10:44 GMT somesoni2 2018-05-21T18:10:44Z https://community.splunk.com/t5/Splunk-Search/how-to-find-out-the-data-available-for-a-sourcetype/m-p/413558#M119177 <P>Hi,<BR /> Can i please know about how to find out a old data available for a sourcetype. For example, if i have a sourcetype "xyx" , i want know until what time period data is available before rolled to frozen for this sourcetype .</P> <P>Thanks</P> Mon, 21 May 2018 17:42:50 GMT https://community.splunk.com/t5/Splunk-Search/how-to-find-out-the-data-available-for-a-sourcetype/m-p/413558#M119177 iamlearner123 2018-05-21T17:42:50Z https://community.splunk.com/t5/Splunk-Search/how-to-find-out-the-data-available-for-a-sourcetype/m-p/413559#M119178 <P>Check out this search</P> <PRE><CODE> | dbinspect index=yourIndex | convert ctime(startTime) | convert ctime(endTime) </CODE></PRE> <P>Or maybe this one </P> <PRE><CODE>| metadata type=sourcetypes </CODE></PRE> Mon, 21 May 2018 18:03:21 GMT https://community.splunk.com/t5/Splunk-Search/how-to-find-out-the-data-available-for-a-sourcetype/m-p/413559#M119178 jkat54 2018-05-21T18:03:21Z https://community.splunk.com/t5/Splunk-Search/how-to-find-out-the-data-available-for-a-sourcetype/m-p/413560#M119179 <P>Hi iamlearner123,<BR /> have you seen Monitoring Console?<BR /> you have a detail for sourcetype (Index Detail: Instance) with the number of events, but you could also extract earlier event.<BR /> Bye.<BR /> Giuseppe</P> Mon, 21 May 2018 18:08:11 GMT https://community.splunk.com/t5/Splunk-Search/how-to-find-out-the-data-available-for-a-sourcetype/m-p/413560#M119179 gcusello 2018-05-21T18:08:11Z https://community.splunk.com/t5/Splunk-Search/how-to-find-out-the-data-available-for-a-sourcetype/m-p/413561#M119180 <P>I'm assuming you want to know the retention period for your data, so here is my response. The retention period is setup at <CODE>index</CODE> level, not at <CODE>sourcetype</CODE> level. So what you need to do is find out which (or which all) index(es) your sourcetype is logging to and find the frozenTimePeriodInSecs attribute for that index (which defines the age of the bucket after it rolls to frozen).</P> <P>Query to find index name:</P> <PRE><CODE>| tstats count WHERE index=* sourcetype=YourSourceTypeHere by index </CODE></PRE> <P>Above will give you one row for each index that sourcetype logs data to. Then for each such index, run following query to find the retention period.</P> <PRE><CODE>| rest /services/data/indexes/indexNameHereFromAboveSearch | stats values(frozenTimePeriodInSecs) as frozenTimePeriodInSecs | eval Age=tostring(frozenTimePeriodInSecs,"duration") </CODE></PRE> Mon, 21 May 2018 18:10:44 GMT https://community.splunk.com/t5/Splunk-Search/how-to-find-out-the-data-available-for-a-sourcetype/m-p/413561#M119180 somesoni2 2018-05-21T18:10:44Z https://community.splunk.com/t5/Splunk-Search/how-to-find-out-the-data-available-for-a-sourcetype/m-p/413562#M119181 <P>Below query can be used to get data age of each sourcetypes.</P> <PRE><CODE>| tstats count min(_time) as firstTime, max(_time) as lastTime, max(_indextime) as recentTime where index=* by sourcetype, index, splunk_server | stats sum(count) as count, min(firstTime) as firstTime, max(lastTime) as lastTime, max(recentTime) as recentTime by sourcetype, index | fields - count | eval data_age=round((lastTime-firstTime)/86400,0) | convert ctime(recentTime) ctime(firstTime) ctime(lastTime) ctime(lastUpdated) | fields index, sourcetype, firstTime, lastTime, data_age </CODE></PRE> <P><STRONG>Note:</STRONG> Make sure to select 'All time' in time-range picker.</P> Fri, 25 Jan 2019 01:39:09 GMT https://community.splunk.com/t5/Splunk-Search/how-to-find-out-the-data-available-for-a-sourcetype/m-p/413562#M119181 jawaharas 2019-01-25T01:39:09Z