I have two search heads, four indexers, and several forwarders.
When I go to Manager -> Indexes, my main index shows N/A in both Earliest event and Latest event. But, I can search events in main index.
Why can I see the earliest and latest time stamp for main index in the Manager?
I would like to see the earliest timestamp and latest timestamp of the main index database for each search peer(indexer).
I can do the following search for All Time. But it takes so long time to finish the search.
index=main splunk_server=myIndexer01
| stats min(_time) AS EarliestTime max(_time) AS LatestTime
| convert ctime(*Time)
Is there any better way to check the earliest timestamp and latest timestamp?
If it is a dedicated search head, user won't see any time range information at Manager --> Indexes, since there is no indexing on the dedicated search head.
In order to see time range information on the search head, please do below search:
| metadata type=hosts index=_internal splunk_server=full_servername | convert ctime(*Time)
Make sure the splunk_server name contain the full server name with domain.
If it is a dedicated search head, user won't see any time range information at Manager --> Indexes, since there is no indexing on the dedicated search head.
In order to see time range information on the search head, please do below search:
| metadata type=hosts index=_internal splunk_server=full_servername | convert ctime(*Time)
Make sure the splunk_server name contain the full server name with domain.