topic Re: Is it possibl to get a list of available indices ? in Splunk Search

Is it possible to get a list of available indices?

flo_cognosec — Mon, 11 Jan 2021 19:33:04 GMT

I could then populate a dropdown list with indices 🙂

Somehow I could not get this done, would be cool if somebody could help me 🙂

I would prefer some in-splunk possibilities compared to file-parsing or CLI foo btw out of obv. reasons.

Re: Is it possibl to get a list of available indices ?

Drainy — Thu, 26 Jan 2012 13:19:34 GMT

Have you had a look at the UI Examples app?
http://splunk-base.splunk.com/apps/22333/splunk-ui-examples-app-for-41

That has some good drop down search examples, so you could just build a drop down form dashboard where the drop down is populated with the results of something like index=* and choose the index fields to get the data.

Re: Is it possibl to get a list of available indices ?

flo_cognosec — Thu, 26 Jan 2012 13:53:11 GMT

Thanks, sometimes you just overlook the obvious 😕

Re: Is it possibl to get a list of available indices ?

gkanapathy — Thu, 26 Jan 2012 15:04:08 GMT

The most efficient way to get accurate results is probably:

| eventcount summarize=false index=* | dedup index | fields index

Just searching for index=* could be inefficient and wrong, e.g., if one index contains billions of events in the last hour, but another's most recent data is back just before midnight, you would either miss out on the second index, or have to retrieve all billions of events just to discover it.

Update:

Corrected to include index=*.
If you want to include internal indexes, you can use:

| eventcount summarize=false index=* index=_* | dedup index | fields index

Re: Is it possibl to get a list of available indices ?

flo_cognosec — Fri, 27 Jan 2012 08:14:54 GMT

This does not give me a list of all available indices, just the ones I set up to be searched by default or am I missing something ?

Re: Is it possibl to get a list of available indices ?

Drainy — Fri, 27 Jan 2012 12:06:10 GMT

Gkanapathy is quite right, my search would be rubbish! @flo_cognosec, the search you need is;
| eventcount summarize=false index=* | dedup index | fields index

Re: Is it possibl to get a list of available indices ?

gkanapathy — Fri, 27 Jan 2012 15:42:47 GMT

Sorry, my mistake. You need to add 'index=*' as an argument to the summarize command, as draineh did.

Re: Is it possibl to get a list of available indices ?

rtadams89 — Fri, 27 Jan 2012 19:00:33 GMT

This will not work. Such a search will only return events indexed locally, and therefore you have the potential to miss a bunch of indexes.

index=* | dedup index | fields index

run over all time

Would be better (in terms of getting all a complete list of indexes), but is not very efficient, it will only show indexes the person running the search has access to.

I don't believe Splunk has a reliable way to get a list of all current indexes through the web GUI (even the management section can be lacking in certain cases).

Re: Is it possibl to get a list of available indices ?

gkanapathy — Fri, 27 Jan 2012 20:32:22 GMT

It is not correct that you will only see local indexes. the eventcount command will return all indexes that can be searched, local or remote distributed ones. But yes, it will only list ones that are accessible to the running user. It is true that Splunk's UI, API, and Management GUI does not provide a way to bypass security restrictions to allow people to list indexes they do not have access to.

Re: Is it possibl to get a list of available indices ?

flo_cognosec — Thu, 02 Feb 2012 12:17:42 GMT

I now hardcoded the index names in a StaticSelect for performance reasons ^^ Technically not pretty but efficient and solves my problem 🙂

Re: Is it possibl to get a list of available indices ?

manikdham — Thu, 04 Oct 2012 14:23:55 GMT

is it possible to exclude some indexes of the list

Re: Is it possibl to get a list of available indices ?

kchen_splunk — Wed, 05 Mar 2014 12:34:35 GMT

$SPLUNK_HOME/bin/splunk list index

Re: Is it possibl to get a list of available indices ?

MuS — Wed, 05 Mar 2014 12:58:47 GMT

and another one

| REST /services/data/indexes | table title

Re: Is it possibl to get a list of available indices ?

kchen_splunk — Wed, 05 Mar 2014 13:05:56 GMT

I like this !

Re: Is it possibl to get a list of available indices ?

koshyk — Fri, 17 Oct 2014 15:17:25 GMT

best answer in my opinion

Re: Is it possibl to get a list of available indices ?

NMSOpsAtTMo — Wed, 01 Apr 2015 15:05:53 GMT

Sweet solution!

Re: Is it possibl to get a list of available indices ?

mendesjo — Wed, 02 Sep 2015 21:40:37 GMT

Brand new stupid user here, my results:

1st suggestion:
| eventcount summarize=false index=* index=_* | dedup index | fields index

= error in eventcount command: this command is not supported in a real-time search

index=* | dedup index | fields index
This works, but doesn't give you a nice list, rather provides tons of individual lines of data

$SPLUNK_HOME/bin/splunk list index
No results at all.

So for me, again newbie here none of these worked for me..

Re: Is it possibl to get a list of available indices ?

emiller42 — Mon, 19 Oct 2015 16:42:59 GMT

Check out MuS's answer. It's the best one for this, and works just fine.

https://answers.splunk.com/answers/39370/is-it-possibl-to-get-a-list-of-available-indices.html#answer-125545

Re: Is it possibl to get a list of available indices ?

wsnyder2 — Mon, 26 Oct 2015 14:55:02 GMT

very nice indeed! thank you .. here is a slight modification.

| REST /services/data/indexes | dedup title | sort title | table title

Re: Is it possibl to get a list of available indices ?

steven_swor — Wed, 25 Nov 2015 00:52:41 GMT

I downvoted this post because the rest answer is the better one. it is more efficient and will include all indices, even empty ones.