How reliable is the metadata command and how can I learn more about how it works?

[hcheang]

Hello

I've been using metadata command for many reports and alarms for new host added, eps and reporting status and now I wonder if the results of metadata command is, in fact, reliable. For other searches, I can actually check by looking at the raw log but not metadata. Can anyone give me a direction where I can find how metadata command works? because in search reference pdf, it doesn't describe where it is fetching those firstTime, lastTime and totalCount from. I just want to confirm what I hope is true is actually true before putting myself in trouble by blindly believing in a command I don't fully understand.

[lguinn2]

In every index, Splunk keeps a variety of information: the raw data, the keyword index, and information about the default fields: source sourcetype and host. This information is updated as new events are added to the index. You can examine (don't change) the files: Hosts.data Sourcetypes.data Sources.data in any index bucket to get an idea of what Splunk keeps.

The only time this information might be off is if you have used the explicit delete command on an index. Note that this would have to been done by an admin. I don't think that the delete command will update these metadata files. But if you have never used delete (and you really shouldn't in a production environment unless it is unavoidable), then the information should be fine.

UPDATE: Or maybe not... a detailed read of the manual entry for the metadata command says: "... in environments with large numbers of values per category, the data might not be complete. This is intentional and allows the metadata command to operate within reasonable time and memory usage." I asked a question about this here.