I am attempting to determine the earliest event in a particular index by executing the following search over All Time (as instructed by the Metadata command). I am running Splunk Enterprise 7.0.2:
| metadata type=hosts index=vpn
Error in 'metadata': No 'host' key found in results. Cannot merge metadata.
If I choose different time periods, some of them work (previous 30 days, Year to Date) but some do not (previous year). Anyone see this before?
@scottprigge,
You can refer this accepted answer and modify as per your requirement:
https://answers.splunk.com/answers/406967/how-to-use-the-metadata-command-to-search-for-host.html
Interestingly enough, this search also fails with the same error I mentioned above:
| metadata type=hosts index=vpn | eval age=now()-firstTime | where age<604800
@scottprigge, can you try the tstats command and see how it behaves:
| tstats count earliest(_time) as EarliestTime latest(_time) as LatestTime where index="vpn" by host
| fieldformat EarliestTime=strftime(EarliestTime,"%Y-%m-%d %H:%M:%S")
| fieldformat LatestTime=strftime(LatestTime,"%Y-%m-%d %H:%M:%S")
That seems to work. Not sure I would have thought to use tstats. Any idea why metadata doesn't work?