Deployment Architecture

How to find time range and 1st and last event indexed in warm bucket events?

aatik5u
Path Finder

Hello,

I have a corrupted warm bucket. What I am trying to do is to find out is the time interval of the events stored in this bucket. I found the file buckt_info.csv where I have _indextime_et that I assume is indextime earliest which means the time the 1st event of the bucket was indexed, right?

how can I find the time range of events in a bucket? in other words, is there a way to find the 1st event indexed in a backet and the last one?

any help will be appreciated.

thank you 🙂 

Labels (1)
Tags (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If you have the name of the bucket then you have the time range.  Bucket names are in the form db_<latest time>_<earliest time>_<id> with variations for indexer clusters.  The key parts for this situation are <latest time> and <earliest time>, which are in epoch form.  Copy these values into a converter (I like https://www.epochconverter.com/) to see values in a more readable format.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

aatik5u
Path Finder

thank you @johnhuang @richgalloway really appreciate it !

0 Karma

johnhuang
Motivator

dbinspect will give you all the info you need about buckets;

 

| dbinspect index=<index_name>

 

https://docs.splunk.com/Documentation/Splunk/9.0.1/SearchReference/Dbinspect

 

richgalloway
SplunkTrust
SplunkTrust

If you have the name of the bucket then you have the time range.  Bucket names are in the form db_<latest time>_<earliest time>_<id> with variations for indexer clusters.  The key parts for this situation are <latest time> and <earliest time>, which are in epoch form.  Copy these values into a converter (I like https://www.epochconverter.com/) to see values in a more readable format.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...