Splunk Search

Finding the earliest event by Splunk server & index

kogane
Path Finder

I'm trying to come up with a query that shows me the earliest (oldest) event in each index on every server that I have. A naive way of doing this might be:

index=* | stats earliest(_time) as earliest_time by splunk_server, index

But I really don't want to run it on all available data... Is there a metadata-based query for getting the same information?

Tags (3)
0 Karma

mpaniagua_splun
Splunk Employee
Splunk Employee

Try | metadata type=hosts, this will give you am good overview

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...