How to find time range and 1st and last event indexed in warm bucket events?

[aatik5u]

Hello,

I have a corrupted warm bucket. What I am trying to do is to find out is the time interval of the events stored in this bucket. I found the file buckt_info.csv where I have _indextime_et that I assume is indextime earliest which means the time the 1st event of the bucket was indexed, right?

how can I find the time range of events in a bucket? in other words, is there a way to find the 1st event indexed in a backet and the last one?

any help will be appreciated.

thank you 🙂 

[aatik5u]

thank you @johnhuang @richgalloway really appreciate it !

[johnhuang]

dbinspect will give you all the info you need about buckets;

| dbinspect index=<index_name>

https://docs.splunk.com/Documentation/Splunk/9.0.1/SearchReference/Dbinspect

[richgalloway · Accepted solution]

If you have the name of the bucket then you have the time range.  Bucket names are in the form db_<latest time>_<earliest time>_<id> with variations for indexer clusters.  The key parts for this situation are <latest time> and <earliest time>, which are in epoch form.  Copy these values into a converter (I like https://www.epochconverter.com/) to see values in a more readable format.