Splunk Search

Splunk Get Earliest Data by Index and Sourcetype

jadengoho
Builder

Hi All,
Is it possible to get the Earliest available date of index and source type .
I tried "Tstats" and "Metadata" but they depend on the search timerange.

I need to get the earliest time that i can still search on Splunk by index and sourcetype that doesn't use "ALLTIME".
A good example would be, data that are 8months ago, without using too much resources. Just let me know if it's possible

0 Karma

nickhills
Ultra Champion

Hi @jadengoho
Try this:

| tstats earliest(sourcetype) as st  where (index=*)  by sourcetype,index,_time span=1d
| sort + _time 
| fields - st
| dedup sourcetype, index

Add any other constraints into the brackets, and run over all time.

If my comment helps, please give it a thumbs up!
0 Karma

jadengoho
Builder

But this command rely on Timerange "ALL TIME".
Im finding a way to get all 25 index earliest event.
How can i do that in the most efficient way ?

0 Karma

nickhills
Ultra Champion

An "All Time" search with tstats is not the same as a regular search with "All Time"
Its using the tsidx files and has a minimal overhead.

On my test system, I just ran this over all time (240 million events, 15 indexes) in 0.11 seconds.

If my comment helps, please give it a thumbs up!
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!