Splunk Enterprise Security

How can you list all indexes and the time of their first indexed event?

endos
New Member

How can you list all indexes and the time of their first indexed event? metadata seems to only show you the hosts, sources or sourcetypes. I can list all indexes with | eventcount summarize=false index=* | dedup index | fields index . Also tried something like this but with no success:

| eventcount summarize=false index=* index=_* | dedup index | fields index 
| map maxsearches=100 search="|metadata type=sourcetypes index=\"$index$\" | eval index=\"$index$\" | stats min(firstTime) as firstTime by sourcetype
| convert ctime(firstTime) "
| fields index sourcetype firstTime

Any ideas?

0 Karma

gjanders
SplunkTrust
SplunkTrust

If you want to know the first time per index and per sourcetype then tstats is a valid solution:

| tstats earliest(_time) AS _time where index=* OR index=_* by index, sourcetype

However going forward you might want to use something like:
Meta Woot! (I believe this records the first seen times as well as the most recently seen once it is scheduled to run)

Or perhaps these apps might have similar info:
Broken Hosts
TrackMe

0 Karma

kimberlytrayson
Path Finder

It's still going to take a while (I assume you're only doing this once) but can use tstats:

| tstats earliest(_time) as firstTime by index
| convert ctime(firstTime)
0 Karma

TISKAR
Builder

Hello,

Can you try this:

index=_*
| stats earliest(_time) as earliest_index by index
| eval earliest_index=strftime(earliest_index,"%Y-%m-%d %H:%M:%S")

🙂

0 Karma

endos
New Member

Thanks for the answer! 🙂
Yeah this would work fine but we have too much data so the search would take too long. Hence the reason why I tried to solve it with |metadata

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...