Getting Data In

How can i list logs files indexed by indexing date?

chlima
Explorer

Hi guys!

I have a folder monitoring stanza (E.g: "C:|logs|client|") and I want list all indexed files from these directory by indexing datetime. How can I do it?

Thanks!

0 Karma
1 Solution

chanfoli
Builder

Since you will likely have an indexed time for every event in the log, you are probably going to want to be a little more specific to summarize this data. Here is something to get you started which will give you the latest index time of an event for each source in your selected time range:

source=* | eval indexed_time=strftime(_indextime, "%+") | stats max(indexed_time) by source

View solution in original post

chanfoli
Builder

Since you will likely have an indexed time for every event in the log, you are probably going to want to be a little more specific to summarize this data. Here is something to get you started which will give you the latest index time of an event for each source in your selected time range:

source=* | eval indexed_time=strftime(_indextime, "%+") | stats max(indexed_time) by source

View solution in original post

chlima
Explorer

It's works!

I made a little change in the query removing the clausule "by source":

source=* | eval indexed_time=strftime(_indextime, "%+") | stats max(indexed_time)

Thanks for the help!

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!