https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-get-a-list-of-all-the-Indexes-which-are-used/m-p/625800#M217520 <P>Hello All:<BR /><BR />I found the following SPL to do exactly what i needed:&nbsp;<BR /><BR />| inputlookup service_kpi_sbs_lookup<BR />| rex field=kpis.base_search "^.*index=(?&lt;indexUsed&gt;\w+)\s"<BR />| rex field=kpis.base_search "^.*index IN\s\((?&lt;indexUsed&gt;[a-zA-Z_,\s]+)\)\s"<BR />| fields indexUsed kpis.title title<BR />| eval indexUsed=mvdedup(indexUsed)&nbsp;<BR /><BR />Cheers.</P> Wed, 04 Jan 2023 12:54:06 GMT Suara 2023-01-04T12:54:06Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-get-a-list-of-all-the-Indexes-which-are-used/m-p/625677#M217476 <P>Hello Community !&nbsp;<BR /><BR />Is it possible to get a list of all the Indexes which are used in ITSI and all the related services to those indexes with a SPL ?&nbsp;<BR /><BR />| REST /services/data/indexes | dedup title | sort title | table title&nbsp; &nbsp; &nbsp;-&nbsp; I found this to be helpful but it's not the answer which i'm looking for.&nbsp;<BR /><BR />Thank you in advance !&nbsp;<BR /><BR /></P> Tue, 03 Jan 2023 16:09:00 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-get-a-list-of-all-the-Indexes-which-are-used/m-p/625677#M217476 Suara 2023-01-03T16:09:00Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-get-a-list-of-all-the-Indexes-which-are-used/m-p/625730#M217497 <P>You can find a list of ITSI indexes at&nbsp;<A href="https://docs.splunk.com/Documentation/ITSI/4.15.0/Install/Indexes#ITSI_indexes" target="_blank">https://docs.splunk.com/Documentation/ITSI/4.15.0/Install/Indexes#ITSI_indexes</A></P><P>To find them programmatically, add a filter on <FONT face="courier new,courier">eai:acl.app</FONT> to your query.</P><LI-CODE lang="markup">| REST /services/data/indexes | search eai:acl.app="SA-IndexCreation" | dedup title | sort title | table title</LI-CODE><P>&nbsp;</P> Tue, 03 Jan 2023 16:00:57 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-get-a-list-of-all-the-Indexes-which-are-used/m-p/625730#M217497 richgalloway 2023-01-03T16:00:57Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-get-a-list-of-all-the-Indexes-which-are-used/m-p/625777#M217512 <P>Hello Rich,<BR /><BR />Thank you for the reply but i'm trying to figure out an SPL that can list all the indexes which we created excluding the default ones. And i'm trying to investigate if there is an SPL also that can list which Services use which Indexes in our environment.&nbsp;<BR /><BR />I have to create a document that lists all of that for our company <span class="lia-unicode-emoji" title=":confused_face:">😕</span></P> Wed, 04 Jan 2023 07:21:14 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-get-a-list-of-all-the-Indexes-which-are-used/m-p/625777#M217512 Suara 2023-01-04T07:21:14Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-get-a-list-of-all-the-Indexes-which-are-used/m-p/625800#M217520 <P>Hello All:<BR /><BR />I found the following SPL to do exactly what i needed:&nbsp;<BR /><BR />| inputlookup service_kpi_sbs_lookup<BR />| rex field=kpis.base_search "^.*index=(?&lt;indexUsed&gt;\w+)\s"<BR />| rex field=kpis.base_search "^.*index IN\s\((?&lt;indexUsed&gt;[a-zA-Z_,\s]+)\)\s"<BR />| fields indexUsed kpis.title title<BR />| eval indexUsed=mvdedup(indexUsed)&nbsp;<BR /><BR />Cheers.</P> Wed, 04 Jan 2023 12:54:06 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-get-a-list-of-all-the-Indexes-which-are-used/m-p/625800#M217520 Suara 2023-01-04T12:54:06Z