Hello,
I have a corrupted warm bucket. What I am trying to do is to find out is the time interval of the events stored in this bucket. I found the file buckt_info.csv where I have _indextime_et that I assume is indextime earliest which means the time the 1st event of the bucket was indexed, right?
how can I find the time range of events in a bucket? in other words, is there a way to find the 1st event indexed in a backet and the last one?
any help will be appreciated.
thank you 🙂
If you have the name of the bucket then you have the time range. Bucket names are in the form db_<latest time>_<earliest time>_<id> with variations for indexer clusters. The key parts for this situation are <latest time> and <earliest time>, which are in epoch form. Copy these values into a converter (I like https://www.epochconverter.com/) to see values in a more readable format.
thank you @johnhuang @richgalloway really appreciate it !
dbinspect will give you all the info you need about buckets;
| dbinspect index=<index_name>
https://docs.splunk.com/Documentation/Splunk/9.0.1/SearchReference/Dbinspect
If you have the name of the bucket then you have the time range. Bucket names are in the form db_<latest time>_<earliest time>_<id> with variations for indexer clusters. The key parts for this situation are <latest time> and <earliest time>, which are in epoch form. Copy these values into a converter (I like https://www.epochconverter.com/) to see values in a more readable format.