Is there a way to find out what the oldest events are, by index, in the local cache when running SmartStore?

[ravida]

Is there a way to find out what the oldest events are, by index,  in the local cache when running SmartStore? I am able to ssh in and look at the local buckets, but is there a way to see it in the monitoring console or by query?

Thanks!

Joe

[AlessioP]

Hi Ravida,

did you find a solution? My team and I are looking for the same type of check to verify that the "Hotlist Recency Seconds" is being respected.

did you try the command dbinspect with option cached(true or false)?

[yeahnah]

I'm no expert on SmartStore by any means, but I doubt it would be possible.  From a Splunk search perspective the underlying storage layer is abstracted - it just looks like disk storage to Splunk - with SmartStore managing the cached data etc.

As the storage cache is a very dynamic environment, constantly changing with new data being ingested (hot buckets) and the search queries constantly being run (older raw data read back into cache) you would only be getting a brief snapshot in time of the oldest events in the an index - if this was possible.

Basically, what are you trying to understand with your query?  You've not provided any context to what you want to achieve.