https://community.splunk.com/t5/Splunk-Search/how-to-find-the-earliest-and-latest-event-in-an-index/m-p/61694#M15221 <P>_indextime is always the time when the event has been index. _time can be a different time, for example when the time found within an event is used</P> Fri, 01 Oct 2010 02:42:13 GMT ziegfried 2010-10-01T02:42:13Z https://community.splunk.com/t5/Splunk-Search/how-to-find-the-earliest-and-latest-event-in-an-index/m-p/61690#M15217 <P>I simply looking for the fist event in an index and the last... to determine how long it took to index x data.</P> <P>any suggestions? i couldn't seem to figure out that query.</P> Fri, 01 Oct 2010 02:21:35 GMT https://community.splunk.com/t5/Splunk-Search/how-to-find-the-earliest-and-latest-event-in-an-index/m-p/61690#M15217 hiddenkirby 2010-10-01T02:21:35Z https://community.splunk.com/t5/Splunk-Search/how-to-find-the-earliest-and-latest-event-in-an-index/m-p/61691#M15218 <P>You can look at the index event times using something like this:</P> <PRE><CODE>| metadata index=main type=hosts | stats min(firstTime) max(lastTime) </CODE></PRE> <P>Or, to examine individual events, you can compare the <CODE>_time</CODE> and <CODE>_indextime</CODE> fields:</P> <PRE><CODE> index=main | eval lag=_indextime-_time | stats avg(lag) ... </CODE></PRE> <P>Do either of these help?</P> Fri, 01 Oct 2010 02:25:17 GMT https://community.splunk.com/t5/Splunk-Search/how-to-find-the-earliest-and-latest-event-in-an-index/m-p/61691#M15218 Lowell 2010-10-01T02:25:17Z https://community.splunk.com/t5/Splunk-Search/how-to-find-the-earliest-and-latest-event-in-an-index/m-p/61692#M15219 <P>Do you mean the time when the event has been indexed? Then the query would be:</P> <PRE><CODE>index=&lt;your_index&gt; | stats min(_indextime) as min_indextime max(_indextime) as max_indextime | convert ctime(min_indextime) ctime(max_indextime) </CODE></PRE> Fri, 01 Oct 2010 02:25:56 GMT https://community.splunk.com/t5/Splunk-Search/how-to-find-the-earliest-and-latest-event-in-an-index/m-p/61692#M15219 ziegfried 2010-10-01T02:25:56Z https://community.splunk.com/t5/Splunk-Search/how-to-find-the-earliest-and-latest-event-in-an-index/m-p/61693#M15220 <P>whats the difference between _indextime and _time?</P> Fri, 01 Oct 2010 02:40:18 GMT https://community.splunk.com/t5/Splunk-Search/how-to-find-the-earliest-and-latest-event-in-an-index/m-p/61693#M15220 hiddenkirby 2010-10-01T02:40:18Z https://community.splunk.com/t5/Splunk-Search/how-to-find-the-earliest-and-latest-event-in-an-index/m-p/61694#M15221 <P>_indextime is always the time when the event has been index. _time can be a different time, for example when the time found within an event is used</P> Fri, 01 Oct 2010 02:42:13 GMT https://community.splunk.com/t5/Splunk-Search/how-to-find-the-earliest-and-latest-event-in-an-index/m-p/61694#M15221 ziegfried 2010-10-01T02:42:13Z https://community.splunk.com/t5/Splunk-Search/how-to-find-the-earliest-and-latest-event-in-an-index/m-p/61695#M15222 <P>_time and _indextime are only equal when you use DATETIME_CONFIG = current in your props config of if no timestamp was detected in the event.</P> Mon, 28 Sep 2020 09:18:21 GMT https://community.splunk.com/t5/Splunk-Search/how-to-find-the-earliest-and-latest-event-in-an-index/m-p/61695#M15222 ziegfried 2020-09-28T09:18:21Z https://community.splunk.com/t5/Splunk-Search/how-to-find-the-earliest-and-latest-event-in-an-index/m-p/61696#M15223 <P>This was helpful.</P> Fri, 01 Oct 2010 02:48:35 GMT https://community.splunk.com/t5/Splunk-Search/how-to-find-the-earliest-and-latest-event-in-an-index/m-p/61696#M15223 hiddenkirby 2010-10-01T02:48:35Z https://community.splunk.com/t5/Splunk-Search/how-to-find-the-earliest-and-latest-event-in-an-index/m-p/61697#M15224 <P>i ended up w/ max(_time) and min(_time) .. convert was very helpful. thank you both.</P> Mon, 28 Sep 2020 09:18:24 GMT https://community.splunk.com/t5/Splunk-Search/how-to-find-the-earliest-and-latest-event-in-an-index/m-p/61697#M15224 hiddenkirby 2020-09-28T09:18:24Z https://community.splunk.com/t5/Splunk-Search/how-to-find-the-earliest-and-latest-event-in-an-index/m-p/61698#M15225 <P>i do have DATATIME_CONFIG = current.</P> Fri, 01 Oct 2010 02:49:34 GMT https://community.splunk.com/t5/Splunk-Search/how-to-find-the-earliest-and-latest-event-in-an-index/m-p/61698#M15225 hiddenkirby 2010-10-01T02:49:34Z https://community.splunk.com/t5/Splunk-Search/how-to-find-the-earliest-and-latest-event-in-an-index/m-p/61699#M15226 <P>look at <BR /> Settings &gt; DATA &gt; Indexes menu.<BR /> There are earliest and last event time by Index.</P> Wed, 21 Jan 2015 08:36:54 GMT https://community.splunk.com/t5/Splunk-Search/how-to-find-the-earliest-and-latest-event-in-an-index/m-p/61699#M15226 joy76 2015-01-21T08:36:54Z https://community.splunk.com/t5/Splunk-Search/how-to-find-the-earliest-and-latest-event-in-an-index/m-p/61700#M15227 <P>Hi Lowell,</P> <P>When I try this command, | metadata index=main type=hosts | stats min(firstTime) max(lastTime), all I get is two columns, min(firstTime) max(lastTime) with time in seconds. </P> <P>Can you please advise where I am getting it wrong ?<BR /> Thanks.<BR /> Dev</P> Thu, 16 Nov 2017 00:07:26 GMT https://community.splunk.com/t5/Splunk-Search/how-to-find-the-earliest-and-latest-event-in-an-index/m-p/61700#M15227 damode 2017-11-16T00:07:26Z https://community.splunk.com/t5/Splunk-Search/how-to-find-the-earliest-and-latest-event-in-an-index/m-p/61701#M15228 <P>Try this<BR /> | metadata index=main type=hosts | stats min(firstTime) max(lastTime) by host</P> Fri, 03 May 2019 21:28:27 GMT https://community.splunk.com/t5/Splunk-Search/how-to-find-the-earliest-and-latest-event-in-an-index/m-p/61701#M15228 khourihan_splun 2019-05-03T21:28:27Z https://community.splunk.com/t5/Splunk-Search/how-to-find-the-earliest-and-latest-event-in-an-index/m-p/539317#M152537 <P>I know thats an old post but i wanted to share a way more efficient solution to get latest timestamp by each index in a "metadata" manor:</P><LI-CODE lang="markup">| rest /services/data/indexes | stats max(maxTime) by title</LI-CODE><P>&nbsp;</P><P>Hop that helps others-</P><P>Cheers&nbsp;</P> Wed, 10 Feb 2021 16:13:23 GMT https://community.splunk.com/t5/Splunk-Search/how-to-find-the-earliest-and-latest-event-in-an-index/m-p/539317#M152537 claudio_manig 2021-02-10T16:13:23Z