topic Re: What are the two ways to list indexes available in splunk search head ? in Splunk Search

What are the two ways to list indexes available in splunk search head ?

Hemnaath — Fri, 21 Sep 2018 13:18:45 GMT

Hi All,

I had two question's on splunk.

1) How to list the indexes details available in splunk search heads?
2) What is streaming and non-streaming commands and how are they executed (in which scenario's it is used)

thanks in advance.

Re: What are the two ways to list indexes available in splunk search head ?

richgalloway — Fri, 21 Sep 2018 14:25:50 GMT

Are these exam questions?

Re: What are the two ways to list indexes available in splunk search head ?

Hemnaath — Sun, 23 Sep 2018 14:16:20 GMT

Hi richgalloway, Its an interview question, which I was unable to answer it, so could guide me on the proper answer to this question.

thanks.

Re: What are the two ways to list indexes available in splunk search head ?

Hemnaath — Mon, 24 Sep 2018 17:49:43 GMT

Hi Guys can any one update me on this ?

Regarding streaming and non-streaming commands, got the below detail on how the commands are executed.

Streaming commands - operates on each event as it is returned by a search. Think of applying "function/transformation" to each event and then writing out the result of that operation. An example of such a command might be a command that adds a field to each event.

Non-streaming commands - Expects to have all the data before it operates on it. An example of a non-streaming command is the stats command, which will collect all the data before it can calculate the statistics.

Similarly for the below question let me know whether answer to the question is correct or not!
1) How to list the indexes details available in splunk search heads?

We can the indexes configured in splunk searched by login into splunk web portal --> settings --> indexes.
By executing the splunk btool command from the search head instances to find the list of indexes available in splunk search head.

./splunk btool indexes list --debug | less

Re: What are the two ways to list indexes available in splunk search head ?

somesoni2 — Mon, 24 Sep 2018 17:57:44 GMT

You can also use REST API endpoints (with | rest command) to know indexes created.
http://docs.splunk.com/Documentation/Splunk/6.2.6/RESTREF/RESTintrospect#data.2Findexes

| rest /services/data/indexes splunk_server=local

Re: What are the two ways to list indexes available in splunk search head ?

rvany — Fri, 16 Nov 2018 13:05:28 GMT

Your splunk btool indexes list --debug just reflects what is in your indexes.conf files. This could fit the active indexes, but only after a restart of Splunk after changes to any your indexes.conf files.