<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How do I search for a list of the most searched indexes and the count for each? in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/How-do-I-search-for-a-list-of-the-most-searched-indexes-and-the/m-p/170507#M48790</link>
    <description>&lt;P&gt;No problem, thanks for clarifying!&lt;/P&gt;</description>
    <pubDate>Thu, 13 Aug 2015 16:03:47 GMT</pubDate>
    <dc:creator>ppablo</dc:creator>
    <dc:date>2015-08-13T16:03:47Z</dc:date>
    <item>
      <title>How do I search for a list of the most searched indexes and the count for each?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-do-I-search-for-a-list-of-the-most-searched-indexes-and-the/m-p/170503#M48786</link>
      <description>&lt;P&gt;Hi, &lt;/P&gt;

&lt;P&gt;I am looking for a list of the most searched indexes and the count for each. Is it possible to get that in Splunk?&lt;/P&gt;

&lt;P&gt;Can someone please share a search for that?&lt;/P&gt;</description>
      <pubDate>Thu, 13 Aug 2015 15:43:36 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-do-I-search-for-a-list-of-the-most-searched-indexes-and-the/m-p/170503#M48786</guid>
      <dc:creator>rameshlpatel</dc:creator>
      <dc:date>2015-08-13T15:43:36Z</dc:date>
    </item>
    <item>
      <title>Re: How do I search for a list of the most searched indexes and the count for each?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-do-I-search-for-a-list-of-the-most-searched-indexes-and-the/m-p/170504#M48787</link>
      <description>&lt;P&gt;Hi @rameshlpatel&lt;/P&gt;

&lt;P&gt;Can you clarify if you're looking for a list of the most searched indexers or most searched indexes? You put "indexes list" in your title but "indexer list" in your content. &lt;/P&gt;</description>
      <pubDate>Thu, 13 Aug 2015 15:55:03 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-do-I-search-for-a-list-of-the-most-searched-indexes-and-the/m-p/170504#M48787</guid>
      <dc:creator>ppablo</dc:creator>
      <dc:date>2015-08-13T15:55:03Z</dc:date>
    </item>
    <item>
      <title>Re: How do I search for a list of the most searched indexes and the count for each?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-do-I-search-for-a-list-of-the-most-searched-indexes-and-the/m-p/170505#M48788</link>
      <description>&lt;P&gt;Something like this can get you started&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;index=_audit action=*search*  search_id=* | table _time search  splunk_server | rex field=search "index\s*=\s*(?&amp;lt;IndexName&amp;gt;\w+)" | stats count by IndexName splunk_server
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Thu, 13 Aug 2015 15:57:19 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-do-I-search-for-a-list-of-the-most-searched-indexes-and-the/m-p/170505#M48788</guid>
      <dc:creator>somesoni2</dc:creator>
      <dc:date>2015-08-13T15:57:19Z</dc:date>
    </item>
    <item>
      <title>Re: How do I search for a list of the most searched indexes and the count for each?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-do-I-search-for-a-list-of-the-most-searched-indexes-and-the/m-p/170506#M48789</link>
      <description>&lt;P&gt;My Bad. most searched indexes .&lt;/P&gt;</description>
      <pubDate>Thu, 13 Aug 2015 16:01:57 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-do-I-search-for-a-list-of-the-most-searched-indexes-and-the/m-p/170506#M48789</guid>
      <dc:creator>rameshlpatel</dc:creator>
      <dc:date>2015-08-13T16:01:57Z</dc:date>
    </item>
    <item>
      <title>Re: How do I search for a list of the most searched indexes and the count for each?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-do-I-search-for-a-list-of-the-most-searched-indexes-and-the/m-p/170507#M48790</link>
      <description>&lt;P&gt;No problem, thanks for clarifying!&lt;/P&gt;</description>
      <pubDate>Thu, 13 Aug 2015 16:03:47 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-do-I-search-for-a-list-of-the-most-searched-indexes-and-the/m-p/170507#M48790</guid>
      <dc:creator>ppablo</dc:creator>
      <dc:date>2015-08-13T16:03:47Z</dc:date>
    </item>
  </channel>
</rss>

