Splunk Search

Why is the metadata command showing the wrong firstTime?

david_halbeisen
New Member
| metadata type=sourcetypes index=*

My time range picker is set to today (Today is July 30, 2015). I analyzed my data and I know for certain that ALL of my sourcetypes have data prior to firstTime. Why is this field reporting wrong information? Actually I have data that is 4 years old for most of my sourcetypes, but the aforementioned search is giving me early July 2015 dates. Thank you for your assistance.

Tags (1)
0 Karma
1 Solution

sduff_splunk
Splunk Employee
Splunk Employee

The metadata command is not designed to honour the time picker. If you need to look at the metadata for a particular time range, you should use the metasearch command (http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/Metasearch)

| metasearch index=* | stats first(_time) as earliest_time, last(_time) as latest_time by sourcetype

Albiet, this is usually slower than the metadata command

View solution in original post

sduff_splunk
Splunk Employee
Splunk Employee

The metadata command is not designed to honour the time picker. If you need to look at the metadata for a particular time range, you should use the metasearch command (http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/Metasearch)

| metasearch index=* | stats first(_time) as earliest_time, last(_time) as latest_time by sourcetype

Albiet, this is usually slower than the metadata command

Gayathirik
Path Finder

Hi

Could you please assist to write a query to find out the newly added host for past 7 days? .

Thanks!!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...