topic Re: How to find the list of indexes and source types in specific app? in Getting Data In

How to find the list of indexes and source types in specific app?

gokikrishnan198 — Wed, 06 Jun 2018 13:10:34 GMT

I have a different kind of access called ELEVATED ACCESS in splunk enterprise which is below the POWER USER but higher than the USER, with different apps installed. I have only one app in that. Is there a way to identify the list of available indexes and source types that is used in my app?

Re: How to find the list of indexes and source types in specific app?

adonio — Wed, 06 Jun 2018 15:14:10 GMT

what do you mean by "used by the app"? do you mean configured under this app e.g. props.conf and indexes.conf and maybe other files are in that app directory? or you refer to what knowledge objects / searches are in this app?
if it is ab RBAC question, an app has no "roles" access to indexes or apps or knowledge objects can be defined per role

Re: How to find the list of indexes and source types in specific app?

renjith_nair — Wed, 06 Jun 2018 15:14:36 GMT

If you have access only to indexes under one app, then you can try

|tstats count by sourcetype where index=* |fields - count

If you need to list down app name as well, then probably need to use rest calls,for eg:

    | rest /servicesNS/-/-/data/indexes  | table title eai:acl.app

This might need additional permissions!

Re: How to find the list of indexes and source types in specific app?

gokikrishnan198 — Thu, 07 Jun 2018 05:32:43 GMT

Our Client uses splunk. All the teams have their own app available in it. We are one of the team as well. In this situation, I could like to know the steps to identify the INDEX and SOURCETYPE?

Re: How to find the list of indexes and source types in specific app?

gokikrishnan198 — Fri, 08 Jun 2018 12:37:07 GMT

Can anybody help me on this?

Re: How to find the list of indexes and source types in specific app?

adonio — Fri, 08 Jun 2018 12:47:07 GMT

@gokikrishnan1982,
sorry but i still not sure what exactly you are looking for.
what is the problem you are trying to solve?
if you are trying to figure out which sourcetypes and indexes are being used by an app, you first have to check the searches / knowledge objects that are under that app and see what sourcetypes and indexes they are running against.
please provide more context and detail so we can better assist you
also, see answer by @renjith.nair, maybe this is what you are looking for

Re: How to find the list of indexes and source types in specific app?

gokikrishnan198 — Tue, 29 Sep 2020 19:52:30 GMT

I am given an app to work within SPLUNK.
I have neither Power User nor ** User role*. Rather I have **Elevated User* role.
I would like to know the DataSummary from where the data is getting pulled.
I would like to know the list of available Indexes and SourceTypes that are used in my app.
Do we have any query to search that information? Please assist me on the same.

Re: How to find the list of indexes and source types in specific app?

gokikrishnan198 — Mon, 11 Jun 2018 07:56:40 GMT

I am able to get the few indexes from the code '|tstats count by sourcetype where index=* |fields - count' you gave. But I am unable to get the source types for the corresponding indexes. Can you help me on that part?

Re: How to find the list of indexes and source types in specific app?

renjith_nair — Tue, 12 Jun 2018 06:20:15 GMT

@gokikrishnan1982, if you just want all indexes and sourcetypes, try

|tstats count by index,sourcetype|fields - count

Re: How to find the list of indexes and source types in specific app?

gokikrishnan198 — Tue, 12 Jun 2018 11:08:46 GMT

Thank you. It worked.

Re: How to find the list of indexes and source types in specific app?

manojannabathin — Tue, 30 Aug 2022 13:25:11 GMT

Any solution on this issue??

i would like to know which application is using which index name