Reporting

How can I produce a report showing the host, oldest data, and newest data?

DPWSplunkPOC
Explorer

How can I produce a report showing the host, oldest data, and newest data? I want to expand on what the metadata search can produce. I'd like to narrow down the hosts to a particular sourcetype.

0 Karma

javiergn
Super Champion

What about this?

| tstats min(_time) as oldestData, max(_time) as newestData where index=YOURINDEXNAMEHERE, sourcetype=YOURSOURCETYPEHERE groupby host
| fieldformat oldestData = strftime(oldestData, "%Y-%m-%d %H:%M:%S")
| fieldformat newestData = strftime(newestData, "%Y-%m-%d %H:%M:%S")

bwooden
Splunk Employee
Splunk Employee

Depending on your goals, the metadata command may work

| metadata type=hosts | convert ctime(firstTime) ctime(lastTime) | rename firstTime as oldestData lastTime as newestData | table host *Data

Edited to add: I missed the second part of your question. You may want to additionally leverage the metasearch command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Metasearch

Off the top of my head, you could join result sets from both metadata and metasearch commands. An example showing first and last timestamp of events from each host having syslog data would look like this:
| metasearch sourcetype=syslog | dedup sourcetype host | join host [| metadata type=hosts] | convert ctime(firstTime) ctime(lastTime) | rename firstTime as oldestData lastTime as newestData | table sourcetype host *Data

0 Karma

DPWSplunkPOC
Explorer

Is there a way to narrow the results of this search to a particular sourcetype?

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...