Archive

How to get the details of index name and who has created it ?

gndivya
Explorer

Is it possible to get the list of all indexes along with the userID who has created that index with the time of creation?
I have tried with | rest /services/data/indexes, where index details (cold, hot, thawed paths) are available but not the creation timestamp and user id.

0 Karma
1 Solution

woodcock
Esteemed Legend

You cannot get this information directly. You could deploy a scripted input to your indexers that does a ls -al /path/to/hot /path/to/cold but this is only going to show you that user splunk owns it. It should show you the creation date, though.

View solution in original post

0 Karma

woodcock
Esteemed Legend

You cannot get this information directly. You could deploy a scripted input to your indexers that does a ls -al /path/to/hot /path/to/cold but this is only going to show you that user splunk owns it. It should show you the creation date, though.

View solution in original post

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!