Dashboards & Visualizations

How can i get the date for my 1st event for the index?

rajhemant26
New Member

Hello everyone.

Want to display the output only for the time which crosses 18 months (earliest time)

Tags (1)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this version a try

| rest /services/data/indexes 
| table title frozenTimePeriodInSecs minTime maxTime totalEventCount
| eval minTime=strptime(minTime,"%FT%T%Z") | eval maxTime=strptime(maxTime,"%FT%T%Z")
| stats sum(totalEventCount) as totalEventCount min(minTime) as minTime max(maxTime) as maxTime values(frozenTimePeriodInSecs) as frozenTimePeriodInSecs by title
| rename title as index
| streamstats count as Row
| eval Days=frozenTimePeriodInSecs/86400
| eval Year=Days/365
| fields Row index frozenTimePeriodInSecs minTime maxTime totalEventCount
| convert ctime(minTime) ctime(maxTime) timeformat="%FT%T%Z"

If you still don't see the time, that is because those indexes do not have any data in them, so there is no minTime/maxTime to display.

0 Karma

DMohn
Motivator

Just use a | tstats earliest(_time) as earliestTime by index | convert ctime(earliestTime) - this will have a look in all indexes and give you the timestamp of the earliest event.

Note - if an indes has no data, nothing will show!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...