how to find the earliest and latest event in an index?

[hiddenkirby]

I simply looking for the fist event in an index and the last... to determine how long it took to index x data.

any suggestions? i couldn't seem to figure out that query.

[claudio_manig]

I know thats an old post but i wanted to share a way more efficient solution to get latest timestamp by each index in a "metadata" manor:

| rest /services/data/indexes
| stats max(maxTime) by title

Hop that helps others-

Cheers 

[khourihan_splun]

Try this
| metadata index=main type=hosts | stats min(firstTime) max(lastTime) by host

[joy76]

look at
Settings > DATA > Indexes menu.
There are earliest and last event time by Index.

[ziegfried · Accepted solution]

Do you mean the time when the event has been indexed? Then the query would be:

index=<your_index> | stats min(_indextime) as min_indextime max(_indextime) as max_indextime | convert ctime(min_indextime) ctime(max_indextime)

[hiddenkirby]

i do have DATATIME_CONFIG = current.

[hiddenkirby]

i ended up w/ max(_time) and min(_time) .. convert was very helpful. thank you both.

[ziegfried]

_time and _indextime are only equal when you use DATETIME_CONFIG = current in your props config of if no timestamp was detected in the event.

[ziegfried]

_indextime is always the time when the event has been index. _time can be a different time, for example when the time found within an event is used

[hiddenkirby]

whats the difference between _indextime and _time?

[Lowell]

You can look at the index event times using something like this:

| metadata index=main type=hosts | stats min(firstTime) max(lastTime)

Or, to examine individual events, you can compare the _time and _indextime fields:

 index=main | eval lag=_indextime-_time | stats avg(lag) ...

Do either of these help?

[damode]

Hi Lowell,

When I try this command, | metadata index=main type=hosts | stats min(firstTime) max(lastTime), all I get is two columns, min(firstTime) max(lastTime) with time in seconds.

Can you please advise where I am getting it wrong ?
Thanks.
Dev

[hiddenkirby]

This was helpful.