topic List of existing indexes in Splunk Search

List of existing indexes

Sailesh6891 — Tue, 09 Dec 2025 17:09:56 GMT

Is it possible to get list of all indexes with creation time and who created the index?

Re: List of existing indexes

PickleRick — Tue, 09 Dec 2025 17:19:39 GMT

There is no such thing as a general "index creation time". And the case of index creator is even more murky if you take into account that indexes can be created by simply creating a config file and restarting the service. Splunk on its own doesn't keep such info directly "attached" to the index. You could try to retrieve events regarding index creation from the _internal index but you are obviously limited to the index's retention period.

Re: List of existing indexes

inventsekar — Tue, 09 Dec 2025 23:21:58 GMT

Hi @Sailesh6891

To list all Splunk indexes, use the search command

1) | metadata type=indexes

2) | rest /services/data/indexes

3) | tstats count where index=* by index

4) with web UI access available(if you have admin access), check Settings > Indexes for a managed view.

for the question - creation time and who created the index

there are no straight forward answer for this(should check about this).

Re: List of existing indexes

PickleRick — Wed, 10 Dec 2025 05:19:12 GMT

That thread is the one I took liberty of "detaching" the post from since it adds additional elements (creator and creation date) to make it unique.