Getting Data In

How can I get oldest event per host from metadata

a212830
Champion

Hi,

Is there a way to get the oldest event dates for certain hosts using metadata?

Tags (2)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi a212830,

from the docs http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Metadata

firstTime is the timestamp for the first time that the indexer saw an event from this host.

Does this not do the job for you? For me it works:

alt text

somesoni2
SplunkTrust
SplunkTrust

The metadata command doesn't provide you mapping of index/sourcetype and host at once. Try following (will take more time but may be the only option)

| metasearch index=* sourcetype=* host=* | stats min(_time) as firstTime by index sourcetype host
0 Karma

a212830
Champion

Sorry - actually needs to include host, index and sourcetype. I get a lot of data for these hosts, so using metadata would be a hug help. We are concerned that data is dropping.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...