Hi, I am now looking for the same thing like you did a long time ago. I want to find out which hosts have been added to Splunk in 2016, just to do a documentation of our data onboarding process. My idea was something like this: | metadata type=sourcetypes |convert ctime(firstTime) AS input_time |convert ctime(lastTime) AS last_event_time |where firstTime>1451606400 AND firstTime<1483228800 Is the metadata affected by the retention policy of an index? For example retention time is set to 180days so firstTime will not be older than 180d max? I checked this, some sourcetypes have events that are older than 2015. But the oldest/earliest event of sourcetype=opsec is just 10 days ago but we did the data input at the beginning of 2016. Are there some reasons why |metadata would not work always? ... View more