How to find the oldest timestamp of an event available for search

[jayakumar89]

I would like to find the oldest timestamp of events available for search (with respect to sourcetype) in an index. Metadata shows the oldest timestamp when data was indexed, but the actual data might have rolled off because of retention policies. Appreciate your help!

[tiagofbmm · Accepted solution]

Data timestamp does not change when data is rolled from hot to warm or warm to cold. So the earliest event can be found by

| tstats earliest(_time) where index = yourindex

[tiagofbmm]

Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that

[jayakumar89]

@tiagofbmm, it really helped. Forgot to update. Thanks For your response!