Getting Data In

How can i list logs files indexed by indexing date?

Explorer

Hi guys!

I have a folder monitoring stanza (E.g: "C:|logs|client|") and I want list all indexed files from these directory by indexing datetime. How can I do it?

Thanks!

0 Karma
1 Solution

Builder

Since you will likely have an indexed time for every event in the log, you are probably going to want to be a little more specific to summarize this data. Here is something to get you started which will give you the latest index time of an event for each source in your selected time range:

source=* | eval indexed_time=strftime(_indextime, "%+") | stats max(indexed_time) by source

View solution in original post

Builder

Since you will likely have an indexed time for every event in the log, you are probably going to want to be a little more specific to summarize this data. Here is something to get you started which will give you the latest index time of an event for each source in your selected time range:

source=* | eval indexed_time=strftime(_indextime, "%+") | stats max(indexed_time) by source

View solution in original post

Explorer

It's works!

I made a little change in the query removing the clausule "by source":

source=* | eval indexed_time=strftime(_indextime, "%+") | stats max(indexed_time)

Thanks for the help!

0 Karma