Splunk Search

how to find out the data available for a sourcetype

iamlearner123
Explorer

Hi,
Can i please know about how to find out a old data available for a sourcetype. For example, if i have a sourcetype "xyx" , i want know until what time period data is available before rolled to frozen for this sourcetype .

Thanks

0 Karma

jawaharas
Motivator

Below query can be used to get data age of each sourcetypes.

| tstats count min(_time) as firstTime, max(_time) as lastTime, max(_indextime) as recentTime where index=*  by sourcetype, index, splunk_server 
| stats sum(count) as count, min(firstTime) as firstTime, max(lastTime) as lastTime, max(recentTime) as recentTime by sourcetype, index 
| fields - count 
| eval data_age=round((lastTime-firstTime)/86400,0)
| convert ctime(recentTime) ctime(firstTime) ctime(lastTime) ctime(lastUpdated) 
| fields index, sourcetype, firstTime, lastTime, data_age

Note: Make sure to select 'All time' in time-range picker.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

I'm assuming you want to know the retention period for your data, so here is my response. The retention period is setup at index level, not at sourcetype level. So what you need to do is find out which (or which all) index(es) your sourcetype is logging to and find the frozenTimePeriodInSecs attribute for that index (which defines the age of the bucket after it rolls to frozen).

Query to find index name:

| tstats count WHERE index=* sourcetype=YourSourceTypeHere by index

Above will give you one row for each index that sourcetype logs data to. Then for each such index, run following query to find the retention period.

| rest /services/data/indexes/indexNameHereFromAboveSearch | stats values(frozenTimePeriodInSecs) as frozenTimePeriodInSecs | eval Age=tostring(frozenTimePeriodInSecs,"duration")
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi iamlearner123,
have you seen Monitoring Console?
you have a detail for sourcetype (Index Detail: Instance) with the number of events, but you could also extract earlier event.
Bye.
Giuseppe

0 Karma

jkat54
SplunkTrust
SplunkTrust

Check out this search

 | dbinspect index=yourIndex | convert ctime(startTime) | convert ctime(endTime)

Or maybe this one

| metadata type=sourcetypes
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...