how to find out the data available for a sourcetype

[iamlearner123]

Hi,
Can i please know about how to find out a old data available for a sourcetype. For example, if i have a sourcetype "xyx" , i want know until what time period data is available before rolled to frozen for this sourcetype .

Thanks

[jawaharas]

Below query can be used to get data age of each sourcetypes.

| tstats count min(_time) as firstTime, max(_time) as lastTime, max(_indextime) as recentTime where index=*  by sourcetype, index, splunk_server 
| stats sum(count) as count, min(firstTime) as firstTime, max(lastTime) as lastTime, max(recentTime) as recentTime by sourcetype, index 
| fields - count 
| eval data_age=round((lastTime-firstTime)/86400,0)
| convert ctime(recentTime) ctime(firstTime) ctime(lastTime) ctime(lastUpdated) 
| fields index, sourcetype, firstTime, lastTime, data_age

Note: Make sure to select 'All time' in time-range picker.

[somesoni2]

I'm assuming you want to know the retention period for your data, so here is my response. The retention period is setup at index level, not at sourcetype level. So what you need to do is find out which (or which all) index(es) your sourcetype is logging to and find the frozenTimePeriodInSecs attribute for that index (which defines the age of the bucket after it rolls to frozen).

Query to find index name:

| tstats count WHERE index=* sourcetype=YourSourceTypeHere by index

Above will give you one row for each index that sourcetype logs data to. Then for each such index, run following query to find the retention period.

| rest /services/data/indexes/indexNameHereFromAboveSearch | stats values(frozenTimePeriodInSecs) as frozenTimePeriodInSecs | eval Age=tostring(frozenTimePeriodInSecs,"duration")

[gcusello]

Hi iamlearner123,
have you seen Monitoring Console?
you have a detail for sourcetype (Index Detail: Instance) with the number of events, but you could also extract earlier event.
Bye.
Giuseppe

[jkat54]

Check out this search

 | dbinspect index=yourIndex | convert ctime(startTime) | convert ctime(endTime)

Or maybe this one

| metadata type=sourcetypes