Hi All,
Is it possible to get the Earliest available date of index and source type .
I tried "Tstats" and "Metadata" but they depend on the search timerange.
I need to get the earliest time that i can still search on Splunk by index and sourcetype that doesn't use "ALLTIME".
A good example would be, data that are 8months ago, without using too much resources. Just let me know if it's possible
Hi @jadengoho
Try this:
| tstats earliest(sourcetype) as st where (index=*) by sourcetype,index,_time span=1d
| sort + _time
| fields - st
| dedup sourcetype, index
Add any other constraints into the brackets, and run over all time.
But this command rely on Timerange "ALL TIME".
Im finding a way to get all 25 index earliest event.
How can i do that in the most efficient way ?
An "All Time" search with tstats is not the same as a regular search with "All Time"
Its using the tsidx files and has a minimal overhead.
On my test system, I just ran this over all time (240 million events, 15 indexes) in 0.11 seconds.