Splunk Search

How to find the earliest event in a query that can search in an index?

xindeNokia
Path Finder

My understanding is Splunk will purge old data in an index when the disk limit is reached.
What is the easy/fast way to find out the earliest available event in an index?

Thanks in advance

0 Karma
1 Solution

niketnilay
Legend

@xindeNokia you can use metadata specific commands like tstats, metadata or dbinspect depending on your use case.
Following are some run anywhere examples based on Splunk's _internal index. Change index name as per your requirement.

tstats:

| tstats earliest(_time) as earliestTime latest(_time) as latestTime count as eventCount where index=_internal
| fieldformat earliestTime=strftime(earliestTime,"%Y/%m/%d %H:%M:%S")
| fieldformat latestTime=strftime(latestTime,"%Y/%m/%d %H:%M:%S")

metadata:

| metadata type=sourcetypes index=_internal
| fieldformat firstTime=strftime(firstTime,"%Y/%m/%d %H:%M:%S")
| fieldformat lastTime=strftime(lastTime,"%Y/%m/%d %H:%M:%S")

PS: stats min(firstTime) can be added to get earliest time across grouped default field in this case sourcetypes

dbinspect:

| dbinspect index=_internal
| fieldformat startEpoch=strftime(startEpoch,"%Y/%m/%d %H:%M:%S")
| fieldformat endEpoch=strftime(endEpoch,"%Y/%m/%d %H:%M:%S")
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketnilay
Legend

@xindeNokia you can use metadata specific commands like tstats, metadata or dbinspect depending on your use case.
Following are some run anywhere examples based on Splunk's _internal index. Change index name as per your requirement.

tstats:

| tstats earliest(_time) as earliestTime latest(_time) as latestTime count as eventCount where index=_internal
| fieldformat earliestTime=strftime(earliestTime,"%Y/%m/%d %H:%M:%S")
| fieldformat latestTime=strftime(latestTime,"%Y/%m/%d %H:%M:%S")

metadata:

| metadata type=sourcetypes index=_internal
| fieldformat firstTime=strftime(firstTime,"%Y/%m/%d %H:%M:%S")
| fieldformat lastTime=strftime(lastTime,"%Y/%m/%d %H:%M:%S")

PS: stats min(firstTime) can be added to get earliest time across grouped default field in this case sourcetypes

dbinspect:

| dbinspect index=_internal
| fieldformat startEpoch=strftime(startEpoch,"%Y/%m/%d %H:%M:%S")
| fieldformat endEpoch=strftime(endEpoch,"%Y/%m/%d %H:%M:%S")
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...