Is there a way to determine the earliest/latest events in an index that has been moved off to Hadoop? I'm running Splunk 7.0.2.
You are correct, when you roll data to Hadoop, the sources is the only available | metadata option
For example, | metadata type=sources index=splunkaccesscombine_archive
Looking at HDFS, I see 4 files and one of them is bucket-metadata.seq, which contains the host and sourcetype. However, I suspect that | metadata does not look inside that file.
Quick update...continued testing confirms that the type=sources
is the only | metadata option that returns any results. The hosts
and sourcetypes
options do not. I'm sure there's a good reason for this, and if anyone knows, I'd be grateful for an explanation.