Find date range of log source

Comments

3 comments

  • Official comment
    Avatar
    Nick

    Hi Peter,

    Is this for a newer source? I don't believe there's a way to do this in the UI, but you could in theory query for this information using the _messageTime field. However, the max you can search back is as far as your retention period. But you could try something like:

    *
    | min(_messageTime), max(_messageTime) by _sourceCategory
    | formatDate(fromMillis(toLong(_min)),"MM-dd-yyyy HH:mm:ss:SSS") as mindate
    | formatDate(fromMillis(toLong(_max)),"MM-dd-yyyy HH:mm:ss:SSS") as maxdate

    Just be sure to set the date range back as far as your retention period. Of course, any source that is older than your retention will potentially (and most likely) not be accurate with this query.

    Thanks,
    Nick
    Customer Success Manager, Sumo Logic

    Comment actions Permalink
  • Avatar
    Peter Lincoln

    Thank you!

    0
    Comment actions Permalink
  • Avatar
    Nick

    You're welcome!

    0
    Comment actions Permalink

Please sign in to leave a comment.