https://community.splunk.com/t5/Splunk-Search/How-do-write-a-search-to-list-all-indexes-associated-with-a/m-p/255769#M76588 <P>Just tried tstats - way faster. Thanks!</P> Fri, 02 Oct 2015 12:17:00 GMT hkj2332 2015-10-02T12:17:00Z https://community.splunk.com/t5/Splunk-Search/How-do-write-a-search-to-list-all-indexes-associated-with-a/m-p/255763#M76582 <P>I have no trouble listing all the sourcetypes associated with an index, but I need to go the other way - What are all the indexes for a given sourcetype. The search I started with for this is:</P> <PRE><CODE>index=* OR index=_* sourcetype= SourceTypeName | dedup index | table index </CODE></PRE> <P>However, this is very slow (not a surprise), and, more a concern, not returning all the indexes that use that sourcetype. </P> <P>Is there a faster search I can use to do this and not miss associated indices? </P> <P>Thanks!</P> Thu, 01 Oct 2015 19:29:44 GMT https://community.splunk.com/t5/Splunk-Search/How-do-write-a-search-to-list-all-indexes-associated-with-a/m-p/255763#M76582 hkj2332 2015-10-01T19:29:44Z https://community.splunk.com/t5/Splunk-Search/How-do-write-a-search-to-list-all-indexes-associated-with-a/m-p/255764#M76583 <P>Hi hkl2332,</P> <P>much faster to use <CODE>metasearch</CODE> as it search only in the metadata of the specified indexes:</P> <PRE><CODE>| metasearch index=* sourcetype=* | stats count by index, sourcetype | fields - count </CODE></PRE> <P>See the docs <A href="http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/Metasearch">http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/Metasearch</A> for more details.</P> <P>cheers, MuS</P> Thu, 01 Oct 2015 19:59:56 GMT https://community.splunk.com/t5/Splunk-Search/How-do-write-a-search-to-list-all-indexes-associated-with-a/m-p/255764#M76583 MuS 2015-10-01T19:59:56Z https://community.splunk.com/t5/Splunk-Search/How-do-write-a-search-to-list-all-indexes-associated-with-a/m-p/255765#M76584 <P>That'll get me a list of all the sourcetypes - any idea how to also get the indices that use that sourcetype in the resulting table?</P> Thu, 01 Oct 2015 20:07:38 GMT https://community.splunk.com/t5/Splunk-Search/How-do-write-a-search-to-list-all-indexes-associated-with-a/m-p/255765#M76584 hkj2332 2015-10-01T20:07:38Z https://community.splunk.com/t5/Splunk-Search/How-do-write-a-search-to-list-all-indexes-associated-with-a/m-p/255766#M76585 <P>Oh sorry my bad <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> mess up <CODE>metadata</CODE> and <CODE>metasearch</CODE> so see my updated answer <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Thu, 01 Oct 2015 20:24:24 GMT https://community.splunk.com/t5/Splunk-Search/How-do-write-a-search-to-list-all-indexes-associated-with-a/m-p/255766#M76585 MuS 2015-10-01T20:24:24Z https://community.splunk.com/t5/Splunk-Search/How-do-write-a-search-to-list-all-indexes-associated-with-a/m-p/255767#M76586 <P>Oh, of course... Thanks!!! I've run this search before, but for some reason I was totally forgetting I can order by EITHER column. Thank you!</P> Thu, 01 Oct 2015 20:28:38 GMT https://community.splunk.com/t5/Splunk-Search/How-do-write-a-search-to-list-all-indexes-associated-with-a/m-p/255767#M76586 hkj2332 2015-10-01T20:28:38Z https://community.splunk.com/t5/Splunk-Search/How-do-write-a-search-to-list-all-indexes-associated-with-a/m-p/255768#M76587 <P>Another faster method availabe 6.1 onward Splunk versions is tstats. Try something like this</P> <PRE><CODE>| tstats count WHERE index=* sourcetype=* by index, sourcetype | fields - count </CODE></PRE> <P>I've seen it run much faster then metasearch.</P> Thu, 01 Oct 2015 22:46:48 GMT https://community.splunk.com/t5/Splunk-Search/How-do-write-a-search-to-list-all-indexes-associated-with-a/m-p/255768#M76587 somesoni2 2015-10-01T22:46:48Z https://community.splunk.com/t5/Splunk-Search/How-do-write-a-search-to-list-all-indexes-associated-with-a/m-p/255769#M76588 <P>Just tried tstats - way faster. Thanks!</P> Fri, 02 Oct 2015 12:17:00 GMT https://community.splunk.com/t5/Splunk-Search/How-do-write-a-search-to-list-all-indexes-associated-with-a/m-p/255769#M76588 hkj2332 2015-10-02T12:17:00Z https://community.splunk.com/t5/Splunk-Search/How-do-write-a-search-to-list-all-indexes-associated-with-a/m-p/255770#M76589 <P>@MuS - Is there anyway to get this working in dependent of time?</P> <P>I want to list ALL index and the sourcetype.</P> Wed, 25 Jan 2017 23:17:03 GMT https://community.splunk.com/t5/Splunk-Search/How-do-write-a-search-to-list-all-indexes-associated-with-a/m-p/255770#M76589 jagadeeshm 2017-01-25T23:17:03Z https://community.splunk.com/t5/Splunk-Search/How-do-write-a-search-to-list-all-indexes-associated-with-a/m-p/255771#M76590 <P>@jagadeeshm you can run a <CODE>tstats</CODE> search </P> <PRE><CODE> | tstats count where index=* by sourcetype, index, _time | timechart sum(count) AS count by index </CODE></PRE> Thu, 26 Jan 2017 23:06:51 GMT https://community.splunk.com/t5/Splunk-Search/How-do-write-a-search-to-list-all-indexes-associated-with-a/m-p/255771#M76590 MuS 2017-01-26T23:06:51Z