How can I get oldest event per host from metadata

[a212830]

Hi,

Is there a way to get the oldest event dates for certain hosts using metadata?

[MuS]

Hi a212830,

from the docs http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Metadata

firstTime is the timestamp for the first time that the indexer saw an event from this host.

Does this not do the job for you? For me it works:

[somesoni2]

The metadata command doesn't provide you mapping of index/sourcetype and host at once. Try following (will take more time but may be the only option)

| metasearch index=* sourcetype=* host=* | stats min(_time) as firstTime by index sourcetype host

[a212830]

Sorry - actually needs to include host, index and sourcetype. I get a lot of data for these hosts, so using metadata would be a hug help. We are concerned that data is dropping.