Security

index

Siddharthnegi
Contributor

Hello I want to see all indexes latest data time. like when did the latest data came to this index.

0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

You can do

| tstats max(_time) as latest where index=* by index

but depending on the time range you use for the search it will only return data for those indexes that have data during that timespan

You can also do 

| rest /services/data/indexes count=0
| table title maxTime minTime

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

You can do

| tstats max(_time) as latest where index=* by index

but depending on the time range you use for the search it will only return data for those indexes that have data during that timespan

You can also do 

| rest /services/data/indexes count=0
| table title maxTime minTime

 

Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...