Data timestamp does not change when data is rolled from hot to warm or warm to cold. So the earliest event can be found by
| tstats earliest(_time) where index = yourindex
Data timestamp does not change when data is rolled from hot to warm or warm to cold. So the earliest event can be found by
| tstats earliest(_time) where index = yourindex
Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that
@tiagofbmm, it really helped. Forgot to update. Thanks For your response!