topic Re: List of all indexes containing access logs in Splunk Search

List of all indexes containing access logs

bl — Wed, 02 Dec 2020 13:34:23 GMT

Hello all, and thanks for the assistance ahead of time. How can I produce a list of all Splunk index names for indexes in my enterprise Splunk Cloud that contain web access log data? Is there a way to do it without scanning all indexes and inspecting data in each one to figure it out?

Re: List of all indexes containing access logs

richgalloway — Wed, 02 Dec 2020 14:32:23 GMT

What identifies web access log data in your Splunk environment?

Re: List of all indexes containing access logs

bl — Wed, 02 Dec 2020 14:51:06 GMT

That's the piece I don't know. Is there an attribute or metadata on an index that says "this index contains web access logs"? I know that choice is made when the index is created; I figured it would be exposed or queryable.

Re: List of all indexes containing access logs

richgalloway — Wed, 02 Dec 2020 15:23:54 GMT

An index is just a bucket into which one dumps data. There is no attribute that says "this index contains web access logs". Even when an index is created, there is no specification of what will go into it other than events or metrics. The data going into an index can change so having such a label would be challenging to manage.

If your data is labeled by sourcetype then you may be in luck. You can list which indexes contain which sourcetypes using a query like this one.

| tstats count where index=* by index,sourcetype | fields - count

Or, if you know the exact sourcetype then

| tstats count where index=* sourcetype=foo by index | fields - count