index start date

[sushil_borah]

I need to generate a daily report in splunk with the list of all the indexes and their earliest event(timestamp) and their latest(timestamp). Is there a way to do it? I have the below queries.

For the start and end time:

| metadata type=sourcetypes index=XXX | stats min(firstTime) AS begin max(lastTime) AS end

For the list of indexes:

| eventcount summarize=false index=* dedup=index | top 0 index | fields index

[andygerber]

Awesome answer. For me this refinement was helpful.

 | rest /services/data/indexes 
 | search totalEventCount > 0 
 | eval now=strftime(now(), "%Y-%m-%d")
 | stats first(maxTime) as "Earliest Event Time" first(minTime) as "Latest Event Time" first(now) as "Current Date" first(currentDBSizeMB) as currentDBSizeMB by title 
 | rename title as "Index" | sort - currentDBSizeMB
 | eval "Index Size in GB"= round(currentDBSizeMB/1000,2)
 | table Index "Earliest Event Time" "Latest Event Time" "Current Date" "Index Size in GB"

[myacoub]

Hello Andygerber,

I just believe you switched the Earliest with the latest in your search , Am i right ?

Thanks

[andygerberkp]

Yes, I believe so... using a different account, or I would edit it. Corrected below:

 | rest /services/data/indexes 
  | search totalEventCount > 0 
  | eval now=strftime(now(), "%Y-%m-%d")
  | stats first(minTime) as "Earliest Event Time" first(maxTime) as "Latest Event Time" first(now) as "Current Date" first(currentDBSizeMB) as currentDBSizeMB by title 
  | rename title as "Index" | sort - currentDBSizeMB
  | eval "Index Size in GB"= round(currentDBSizeMB/1000,2)
  | table Index "Earliest Event Time" "Latest Event Time" "Current Date" "Index Size in GB"

[araitz · Accepted solution]

Schedule this to run daily:

| rest /services/data/indexes 
| search totalEventCount > 0 
| eval now=strftime(now(), "%Y-%m-%d")
| stats first(maxTime) as maxTime first(minTime) as minTime first(now) as now first(currentDBSizeMB) as currentDBSizeMB by title 

[araitz]

It is the total size of the index in MB at the time that the search was run.

[sushil_borah]

does currentDBSizeMB lists the total index volume?

[araitz]

see my update above.

[sushil_borah]

is it possible to add the index volume to the above genertated report?

[araitz]

That's why I am here 🙂

[sushil_borah]

thanks thats exactly what i needed