Splunk Search

Finding the earliest event by Splunk server & index

kogane
Path Finder

I'm trying to come up with a query that shows me the earliest (oldest) event in each index on every server that I have. A naive way of doing this might be:

index=* | stats earliest(_time) as earliest_time by splunk_server, index

But I really don't want to run it on all available data... Is there a metadata-based query for getting the same information?

Tags (3)
0 Karma

mpaniagua_splun
Splunk Employee
Splunk Employee

Try | metadata type=hosts, this will give you am good overview

0 Karma
Get Updates on the Splunk Community!

Super Optimize your Splunk Stats Searches: Unlocking the Power of tstats, TERM, and ...

By Martin Hettervik, Senior Consultant and Team Leader at Accelerate at Iver, Splunk MVPThe stats command is ...

How Splunk Observability Cloud Prevented a Major Payment Crisis in Minutes

Your bank's payment processing system is humming along during a busy afternoon, handling millions in hourly ...

Index This | What’s a riddle wrapped in an enigma?

September 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...