I'm unclear if this is the correct way to go about finding the earliest/latest event time in a bucket.
| dbinspect index=wineventlog state=warm
| search tsidxState="full"
| eval sizeOnDiskGB=round(sizeOnDiskMB / 1024, 2)
| stats min(startEpoch) as earliestTime, max(endEpoch) as latestTime, count(path) as numberOfBuckets, sum(sizeOnDiskGB) as totalSizeOnDiskGB by splunk_server
| eval earliestTime=strftime(earliestTime,"%Y/%m/%d %H:%M:%S")
| eval latestTime=strftime(latestTime,"%Y/%m/%d %H:%M:%S")
For this example, i'm specifically looking at finding the earliestTime in warm buckets. I set the time picker and found a date that may be what I'm looking for. Although I'm not sure if this is how I should go about finding such info?
