How to get the Earliest/latest events in a Hadoop index?

[_smp_]

Is there a way to determine the earliest/latest events in an index that has been moved off to Hadoop? I'm running Splunk 7.0.2.

[rdagan_splunk]

You are correct, when you roll data to Hadoop, the sources is the only available | metadata option
For example, | metadata type=sources index=splunkaccesscombine_archive
Looking at HDFS, I see 4 files and one of them is bucket-metadata.seq, which contains the host and sourcetype. However, I suspect that | metadata does not look inside that file.

[_smp_]

Quick update...continued testing confirms that the type=sources is the only | metadata option that returns any results. The hosts and sourcetypes options do not. I'm sure there's a good reason for this, and if anyone knows, I'd be grateful for an explanation.