Dashboards & Visualizations

how to pull the index and app\workspace names on Splunk search heads?

yu94
New Member

Hi,

Can you please help me to write a query to run on the search heads which will list me the index and app\workspace names in a tabular format?

It would be even helpful if you can write a query to display like these are the indexes in this App\Workspace.

This is basically to give an idea to a new user to get started.. If i can build a dashboard which will list out the list of indexes in each workspace it would help them to identify their workspace\app and indexes in it.

Thanks,
Thippesh

0 Karma

MuS
Legend

Hi yu94,

as admin user you can run this search:

| rest /servicesNS/-/-/data/indexes
| table title eai:acl.app 
| rename "eai:acl.app" AS app title AS index 
| stats count values(index) AS index by app

to get a table of indexes per app.
If you don't have the admin role assigned, ask your friendly Splunk admin to create a saved search and report/dashboard for you.

Hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...