Hi..
I have certain indexes say "myperf" and "myapp" of 60 GB Size . Now in these indexes i need to calucalte how many days of data is present . i.e in that 60 GB size how many days of data can i see in my index before moving the data from hot to cold.
I have tried this ..
index=myperf | stats earliest(_indextime) as earliest latest(_indextime) as latest | eval duration = latest - earliest | eval Days = (duration/(24*60))
this seems to be not working..
tried one more like this
index=myperf | eval Day=strftime(_time,"%d-%b-%y") | stats dc(Day)
this is taking so much time . Is there any way i can get the Days count pls ??
Hi
Found the ans with the following query ..
| metadata index=myperf type=hosts | stats max(lastTime) as lastTime, min(firstTime) as firstTime | eval duration = lastTime - firstTime | eval Days = (duration/(24*60*60))
🙂