Getting Data In

How can i list logs files indexed by indexing date?

chlima
Explorer

Hi guys!

I have a folder monitoring stanza (E.g: "C:|logs|client|") and I want list all indexed files from these directory by indexing datetime. How can I do it?

Thanks!

0 Karma
1 Solution

chanfoli
Builder

Since you will likely have an indexed time for every event in the log, you are probably going to want to be a little more specific to summarize this data. Here is something to get you started which will give you the latest index time of an event for each source in your selected time range:

source=* | eval indexed_time=strftime(_indextime, "%+") | stats max(indexed_time) by source

View solution in original post

chanfoli
Builder

Since you will likely have an indexed time for every event in the log, you are probably going to want to be a little more specific to summarize this data. Here is something to get you started which will give you the latest index time of an event for each source in your selected time range:

source=* | eval indexed_time=strftime(_indextime, "%+") | stats max(indexed_time) by source

chlima
Explorer

It's works!

I made a little change in the query removing the clausule "by source":

source=* | eval indexed_time=strftime(_indextime, "%+") | stats max(indexed_time)

Thanks for the help!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...