Splunk Search

how to find out the data available for a sourcetype

iamlearner123
Explorer

Hi,
Can i please know about how to find out a old data available for a sourcetype. For example, if i have a sourcetype "xyx" , i want know until what time period data is available before rolled to frozen for this sourcetype .

Thanks

0 Karma

jawaharas
Motivator

Below query can be used to get data age of each sourcetypes.

| tstats count min(_time) as firstTime, max(_time) as lastTime, max(_indextime) as recentTime where index=*  by sourcetype, index, splunk_server 
| stats sum(count) as count, min(firstTime) as firstTime, max(lastTime) as lastTime, max(recentTime) as recentTime by sourcetype, index 
| fields - count 
| eval data_age=round((lastTime-firstTime)/86400,0)
| convert ctime(recentTime) ctime(firstTime) ctime(lastTime) ctime(lastUpdated) 
| fields index, sourcetype, firstTime, lastTime, data_age

Note: Make sure to select 'All time' in time-range picker.

0 Karma

somesoni2
Revered Legend

I'm assuming you want to know the retention period for your data, so here is my response. The retention period is setup at index level, not at sourcetype level. So what you need to do is find out which (or which all) index(es) your sourcetype is logging to and find the frozenTimePeriodInSecs attribute for that index (which defines the age of the bucket after it rolls to frozen).

Query to find index name:

| tstats count WHERE index=* sourcetype=YourSourceTypeHere by index

Above will give you one row for each index that sourcetype logs data to. Then for each such index, run following query to find the retention period.

| rest /services/data/indexes/indexNameHereFromAboveSearch | stats values(frozenTimePeriodInSecs) as frozenTimePeriodInSecs | eval Age=tostring(frozenTimePeriodInSecs,"duration")
0 Karma

gcusello
Legend

Hi iamlearner123,
have you seen Monitoring Console?
you have a detail for sourcetype (Index Detail: Instance) with the number of events, but you could also extract earlier event.
Bye.
Giuseppe

0 Karma

jkat54
SplunkTrust
SplunkTrust

Check out this search

 | dbinspect index=yourIndex | convert ctime(startTime) | convert ctime(endTime)

Or maybe this one

| metadata type=sourcetypes
0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...