- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Siddharthnegi
Contributor
11-25-2024
09:18 PM
Hello I want to see all indexes latest data time. like when did the latest data came to this index.
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
bowesmana

SplunkTrust
11-25-2024
10:13 PM
You can do
| tstats max(_time) as latest where index=* by index
but depending on the time range you use for the search it will only return data for those indexes that have data during that timespan
You can also do
| rest /services/data/indexes count=0
| table title maxTime minTime
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
bowesmana

SplunkTrust
11-25-2024
10:13 PM
You can do
| tstats max(_time) as latest where index=* by index
but depending on the time range you use for the search it will only return data for those indexes that have data during that timespan
You can also do
| rest /services/data/indexes count=0
| table title maxTime minTime
