How do I query for the oldest event in the decoder/concentrator?

[DionStempfley]

I'm trying to monitor retention and want to query my decoders and concentrators for the date of the oldest event record.  I know it's available through explore of the service but don't recall how to query it.  Can I also use the rest interface?

[NaushadKasu1]

What version of NW? If you’re on 10.6.3 or later, you can go to Administration --> Health and Wellness --> Sys Stats Browser and select Decoder (or Log Decoder) from the Component drop-down, then hit Apply. You will find a metric called ‘packet.oldest.file.time’ – that will be your oldest packet session on the Decoders. For Concentrator, you need to look for meta.oldest.file.time.

If you are on an older version of NW, you will need to go to the View -> Explore view (or http://

UPCOMING OUT OF OFFICE

Conference: Aug 21-24, Training: October 3-6

<https://community.rsa.com/welcome>

<https://community.rsa.com/welcome>

[PeterLester]

Naushad (above) has also done a brilliant eLearning and eLab available for customers for a fee and to Internals at no charge - in case you want to learn more about REST.  Use REST to pull stats, prove ROI, etc.

You can search Edutube for individual videos https://edutube.emc.com/html5/home.htm  (keyword REST)or sign up for the course at RSA University at https://community.rsa.com/community/training   or just watch the "teaser" on YouTube RSA NetWitness - Introduction to the REST API - YouTube 

[DionStempfley]

Thanks.  That got me the information I needed.  Query through  REST is still something I want, but I will look at the material that Peter suggested.  

[Anonymous]

Look at the script on https://community.rsa.com/thread/134393 it does that and quite a few more stats. You can remove all others and keep just the one you want.

Hope it helps!

[MansoorIlahiMoh]

Hi Naushad, I'm using 11.0.1 version or RSA SA. I don't see the statistic parameter "packet.oldest.file.time" listed under Decoder/Log Decoder. Can you suggest any workaround? 

Thanks in advance.

Regards,

Mansoor Ilahi

[NaushadKasu1]

I’m not sure what happened to that metric, I will look into it. But if you want to see your oldest packet in your Decoder, enter this into the Statistic field in System Stats Browser... “Packet Time Begin”.

Sent from my iPhone