topic Re: index data in Splunk Search

index data

Siddharthnegi — Fri, 21 Jun 2024 05:58:35 GMT

Hello , How can I know the start time and the latest time coming of data of all index .
meaning that when was the first time data came in that index and when is the latest time data have came in that index.

Re: index data

yuanliu — Fri, 21 Jun 2024 06:17:14 GMT

Do you really want to know the times in the entire index? If so, tstats is usually the way to go.

| tstats min(_time) as start max(_time) as end where index=myindex | fieldformat start = strftime(start, "%F %T") | fieldformat end = strftime(end, "%F %T")

Something like that.

Re: index data

Siddharthnegi — Fri, 21 Jun 2024 06:26:53 GMT

Thank You for your reply , but I want this information for all indexes at once with their respective names is that possible?

Re: index data

yuanliu — Fri, 21 Jun 2024 08:30:21 GMT

This is where you need to be extra diligent in problem statement. Yes, it is doable but volunteers are not mind readers.

| tstats min(_time) as start max(_time) as end where index=* by index | fieldformat start = strftime(start, "%F %T") | fieldformat end = strftime(end, "%F %T")