I need to make a dashboard providing evidence of compliance for our auditors. I was going to use the tail command but it's VERY slow even with the fact I only have a few hundred megs of data right now. Any tricks here to speed this up?
index=os source=/var/log/secure | table _raw | tail 1
Do you need the actual event itself, or just the timestamp of the oldest event?
For the latter, a
| metadata search would be most efficient I guess. So something along the lines of:
| metadata type=sources index=os source=/var/log/secure | table firstTime,source | convert ctime(firstTime)
you are passing all the events in the world through the table command only to look for the last one
index=os source=/var/log/secure | tail 1 | table _raw