How can i list logs files indexed by indexing date?

[chlima]

Hi guys!

I have a folder monitoring stanza (E.g: "C:|logs|client|") and I want list all indexed files from these directory by indexing datetime. How can I do it?

Thanks!

[chanfoli · Accepted solution]

Since you will likely have an indexed time for every event in the log, you are probably going to want to be a little more specific to summarize this data. Here is something to get you started which will give you the latest index time of an event for each source in your selected time range:

source=* | eval indexed_time=strftime(_indextime, "%+") | stats max(indexed_time) by source

[chlima]

It's works!

I made a little change in the query removing the clausule "by source":

source=* | eval indexed_time=strftime(_indextime, "%+") | stats max(indexed_time)

Thanks for the help!