All Apps and Add-ons

How to get the Earliest/latest events in a Hadoop index?

_smp_
Builder

Is there a way to determine the earliest/latest events in an index that has been moved off to Hadoop? I'm running Splunk 7.0.2.

0 Karma

rdagan_splunk
Splunk Employee
Splunk Employee

You are correct, when you roll data to Hadoop, the sources is the only available | metadata option
For example, | metadata type=sources index=splunkaccesscombine_archive
Looking at HDFS, I see 4 files and one of them is bucket-metadata.seq, which contains the host and sourcetype. However, I suspect that | metadata does not look inside that file.

0 Karma

_smp_
Builder

Quick update...continued testing confirms that the type=sources is the only | metadata option that returns any results. The hosts and sourcetypes options do not. I'm sure there's a good reason for this, and if anyone knows, I'd be grateful for an explanation.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...