Hi. I have been trying to create a search that will return the _indextime (because log times of events may not be reliable) of the earliest event for each index which I will use to determine how long data is retained.
Currently my search is: index=* | chart min(_indextime) by index
Is there a way to speed up this search or another way to obtain this information with out going thorough every event on every index?
... View more