Splunk Search

Why are there no time stamp in Earliest and Latest Events for main index

Masa
Splunk Employee
Splunk Employee

I have two search heads, four indexers, and several forwarders.
When I go to Manager -> Indexes, my main index shows N/A in both Earliest event and Latest event. But, I can search events in main index.

Why can I see the earliest and latest time stamp for main index in the Manager?

I would like to see the earliest timestamp and latest timestamp of the main index database for each search peer(indexer).

I can do the following search for All Time. But it takes so long time to finish the search.


index=main splunk_server=myIndexer01
| stats min(_time) AS EarliestTime max(_time) AS LatestTime
| convert ctime(*Time)

Is there any better way to check the earliest timestamp and latest timestamp?

Tags (1)
1 Solution

zliu
Splunk Employee
Splunk Employee

If it is a dedicated search head, user won't see any time range information at Manager --> Indexes, since there is no indexing on the dedicated search head.

In order to see time range information on the search head, please do below search:

| metadata type=hosts index=_internal splunk_server=full_servername | convert ctime(*Time)

Make sure the splunk_server name contain the full server name with domain.

View solution in original post

zliu
Splunk Employee
Splunk Employee

If it is a dedicated search head, user won't see any time range information at Manager --> Indexes, since there is no indexing on the dedicated search head.

In order to see time range information on the search head, please do below search:

| metadata type=hosts index=_internal splunk_server=full_servername | convert ctime(*Time)

Make sure the splunk_server name contain the full server name with domain.

Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2024 Splunk Career Impact Report

We’ve been buzzing with excitement about the recent validation of Splunk Education! The 2024 Splunk Career ...

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...