Splunk Search

index data

Siddharthnegi
Contributor

Hello , How can I know the start time and the latest time  coming of data of all index .
meaning that when was the first time data came in that index and when is the latest time data have came in that index.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Do you really want to know the times in the entire index?  If so, tstats is usually the way to go.

| tstats min(_time) as start max(_time) as end where index=myindex
| fieldformat start = strftime(start, "%F %T")
| fieldformat end = strftime(end, "%F %T")

Something like that.

Siddharthnegi
Contributor

Thank You for your reply , but I want this information for all indexes  at once with their respective names is that possible?

0 Karma

yuanliu
SplunkTrust
SplunkTrust

This is where you need to be extra diligent in problem statement.  Yes, it is doable but volunteers are not mind readers.

| tstats min(_time) as start max(_time) as end where index=* by index
| fieldformat start = strftime(start, "%F %T")
| fieldformat end = strftime(end, "%F %T")

 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...