I have two search heads, four indexers, and several forwarders.
When I go to Manager -> Indexes, my main index shows N/A in both Earliest event and Latest event. But, I can search events in main index.
Why can I see the earliest and latest time stamp for main index in the Manager?
I would like to see the earliest timestamp and latest timestamp of the main index database for each search peer(indexer).
I can do the following search for All Time. But it takes so long time to finish the search.
| stats min(_time) AS EarliestTime max(_time) AS LatestTime
| convert ctime(*Time)
Is there any better way to check the earliest timestamp and latest timestamp?