index data

[Siddharthnegi]

Hello , How can I know the start time and the latest time  coming of data of all index .
meaning that when was the first time data came in that index and when is the latest time data have came in that index.

[yuanliu]

Do you really want to know the times in the entire index?  If so, tstats is usually the way to go.

| tstats min(_time) as start max(_time) as end where index=myindex
| fieldformat start = strftime(start, "%F %T")
| fieldformat end = strftime(end, "%F %T")

Something like that.

[Siddharthnegi]

Thank You for your reply , but I want this information for all indexes  at once with their respective names is that possible?

[yuanliu]

This is where you need to be extra diligent in problem statement.  Yes, it is doable but volunteers are not mind readers.

| tstats min(_time) as start max(_time) as end where index=* by index
| fieldformat start = strftime(start, "%F %T")
| fieldformat end = strftime(end, "%F %T")