topic Oldest and Latest Logs per Index in Splunk Search

Oldest and Latest Logs per Index

ssingh5 — Mon, 28 Sep 2020 11:35:35 GMT

I would like to see the list of all the Indexes along with the Earliest and Latest Time stamp for the most oldest log and most earliest log stored in that index.

I used following qeuery but i take to much time to provide the resluts, is their any other method to see this information as quick as possible.

index=* | stats first(_time) as latest last(_time) as earliest by index | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(earliest) ctime(latest)

Re: Oldest and Latest Logs per Index

kristian_kolb — Thu, 29 Mar 2012 12:00:09 GMT

You could probably find a metadata search to do what you want:

| metadata type=sourcetypes index=main| stats min(firstTime) AS begin max(lastTime) AS end  | eval begin = strftime(begin, "%Y-%m-%d %H:%M:%S") | eval end = strftime(end, "%Y-%m-%d %H:%M:%S")

For more information, see http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Metadata

Hope this helps,

Kristian