Splunk Search

Why are there no time stamp in Earliest and Latest Events for main index

Splunk Employee
Splunk Employee

I have two search heads, four indexers, and several forwarders.
When I go to Manager -> Indexes, my main index shows N/A in both Earliest event and Latest event. But, I can search events in main index.

Why can I see the earliest and latest time stamp for main index in the Manager?

I would like to see the earliest timestamp and latest timestamp of the main index database for each search peer(indexer).

I can do the following search for All Time. But it takes so long time to finish the search.


index=main splunk_server=myIndexer01
| stats min(_time) AS EarliestTime max(_time) AS LatestTime
| convert ctime(*Time)

Is there any better way to check the earliest timestamp and latest timestamp?

Tags (1)
1 Solution

Splunk Employee
Splunk Employee

If it is a dedicated search head, user won't see any time range information at Manager --> Indexes, since there is no indexing on the dedicated search head.

In order to see time range information on the search head, please do below search:

| metadata type=hosts index=_internal splunk_server=full_servername | convert ctime(*Time)

Make sure the splunk_server name contain the full server name with domain.

View solution in original post

Splunk Employee
Splunk Employee

If it is a dedicated search head, user won't see any time range information at Manager --> Indexes, since there is no indexing on the dedicated search head.

In order to see time range information on the search head, please do below search:

| metadata type=hosts index=_internal splunk_server=full_servername | convert ctime(*Time)

Make sure the splunk_server name contain the full server name with domain.

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!