I have a distributed index model and I would like to use the search head to find out what the oldest event is per source or sourcetype.
I tried using the metadata command but nothing comes up, do I have to do this search on the indexer? Is there a way to search this just on the search head?
suhprano,
The "| metadata" command will distribute to all servers in your distributed search pool. The reason you may not be getting results back could be caused by your data being in non-default indexes. Have you tried:
| metadata type=sources index=*
Your role should also have the get_metadata capability (get_metadata is a shipped capability of all roles).
Update:
Based on your comment below make sure you are using valid types. Valid types are:
type=sources
type=hosts
type=sourcetypes
I wanted the timestamp of the oldest event to be in human interpretable form, so I added a strftime call. For me, to find the oldest record from my vpn log source, I used
| metadata type=sources index=* | where source="/log/sources/myvpn/myvpn.log" | eval str_firstTime=strftime(firstTime,"%Y-%m-%d %H:%M")
That gave me the oldest event for that particular source in a format that was easy to read
suhprano,
The "| metadata" command will distribute to all servers in your distributed search pool. The reason you may not be getting results back could be caused by your data being in non-default indexes. Have you tried:
| metadata type=sources index=*
Your role should also have the get_metadata capability (get_metadata is a shipped capability of all roles).
Update:
Based on your comment below make sure you are using valid types. Valid types are:
type=sources
type=hosts
type=sourcetypes
Thanks for the info, but it appears that it only retrieves one epoch time for all source/sourcetypes. Is there a way to find the oldest event regarding a particular sourcetype?
Your search looks good except for type=sourcestypes. Should either be type=sources or type=sourcetypes
Sorry, I'm still not seeing it. I'm also trying on the actual indexes and nothing comes up. This is the search I'm running:
| metadata type=sourcestypes index=*| stats min(firstTime) as firstTime
Could it be the (firstTime) field? I don't know if that's the right syntax or parameter I should be passing.