topic Re: Why does the following search not return a list of my indexes? in Getting Data In

Why does the following search not return a list of my indexes?

asturt — Fri, 05 Oct 2018 15:11:37 GMT

| REST /services/data/indexes

The search shown above is supposed to return a list of all my indexes. It doesn't. I have an index that has 54,000+ events for the last fifteen minutes alone, but it is not included in the list coming back from the rest call.

Am I doing something wrong?

Re: Why does the following search not return a list of my indexes?

somesoni2 — Fri, 05 Oct 2018 16:24:58 GMT

It returns list of index that the user running above search has access to. Check the role of user running this search to see if that indexes is accessible to user.

Re: Why does the following search not return a list of my indexes?

asturt — Fri, 05 Oct 2018 17:41:45 GMT

I am the user running the report, and it doesn't show all the indexes I can search.

Re: Why does the following search not return a list of my indexes?

vinaykata — Fri, 05 Oct 2018 18:38:03 GMT

have you tried the basic searches

index="" OR index="_" | dedup index | table index

Re: Why does the following search not return a list of my indexes?

asturt — Fri, 05 Oct 2018 20:39:01 GMT

Well, that works if I change index="" OR index="_" into index="", but the rest service also provides statistics like totalEventCount. At least, it *should provide those, but all of that information seems to be incorrect.

Re: Why does the following search not return a list of my indexes?

Vijeta — Fri, 05 Oct 2018 20:47:09 GMT

Are you running rest command on your indexer or Search head? If running on search head and index is on indexer , you might not be having the privilege to get data using REST from another server except localhost

Re: Why does the following search not return a list of my indexes?

asturt — Fri, 05 Oct 2018 20:56:55 GMT

Well, that's an excellent question, Vijeta. I thought I was running it against the head, but that might be a false assumption. I'll have to check with our admin to find out.

Re: Why does the following search not return a list of my indexes?

JeffBothel — Fri, 05 Oct 2018 21:02:17 GMT

The below link is what I have saved for answering this question and seems to work pretty well for me:

https://answers.splunk.com/answers/39370/is-it-possibl-to-get-a-list-of-available-indices.html