How would i calucate the no of days that the data is present in my indexes ??

[rakesh_498115]

Hi..

I have certain indexes say "myperf" and "myapp" of 60 GB Size . Now in these indexes i need to calucalte how many days of data is present . i.e in that 60 GB size how many days of data can i see in my index before moving the data from hot to cold.

I have tried this ..

index=myperf | stats earliest(_indextime) as earliest latest(_indextime) as latest | eval duration = latest - earliest | eval Days = (duration/(24*60))

this seems to be not working..

tried one more like this

index=myperf | eval Day=strftime(_time,"%d-%b-%y") | stats dc(Day)

this is taking so much time . Is there any way i can get the Days count pls ??

[rakesh_498115]

Hi

Found the ans with the following query ..

| metadata index=myperf type=hosts | stats max(lastTime) as lastTime, min(firstTime) as firstTime | eval duration = lastTime - firstTime | eval Days = (duration/(24*60*60))

🙂