I want to find the earliest _indextime by host for all my indexes. Specifically I need to know when the each forwarder first started indexing data... NOT the earliest timestamp of an event, but when the data itself was actually forwarded and indexed.
I can do this obviously
index=* | chart min(_indextime) as first by host | fieldformat "first"=strftime('first', "%c")
but it takes a while. Is there a way to do this more cheaply?