Splunk Search

Why are there no time stamp in Earliest and Latest Events for main index

Masa
Splunk Employee
Splunk Employee

I have two search heads, four indexers, and several forwarders.
When I go to Manager -> Indexes, my main index shows N/A in both Earliest event and Latest event. But, I can search events in main index.

Why can I see the earliest and latest time stamp for main index in the Manager?

I would like to see the earliest timestamp and latest timestamp of the main index database for each search peer(indexer).

I can do the following search for All Time. But it takes so long time to finish the search.


index=main splunk_server=myIndexer01
| stats min(_time) AS EarliestTime max(_time) AS LatestTime
| convert ctime(*Time)

Is there any better way to check the earliest timestamp and latest timestamp?

Tags (1)
1 Solution

zliu
Splunk Employee
Splunk Employee

If it is a dedicated search head, user won't see any time range information at Manager --> Indexes, since there is no indexing on the dedicated search head.

In order to see time range information on the search head, please do below search:

| metadata type=hosts index=_internal splunk_server=full_servername | convert ctime(*Time)

Make sure the splunk_server name contain the full server name with domain.

View solution in original post

zliu
Splunk Employee
Splunk Employee

If it is a dedicated search head, user won't see any time range information at Manager --> Indexes, since there is no indexing on the dedicated search head.

In order to see time range information on the search head, please do below search:

| metadata type=hosts index=_internal splunk_server=full_servername | convert ctime(*Time)

Make sure the splunk_server name contain the full server name with domain.

Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...