Deployment Architecture

How to get the details of index name and who has created it ?

gndivya
Explorer

Is it possible to get the list of all indexes along with the userID who has created that index with the time of creation?
I have tried with | rest /services/data/indexes, where index details (cold, hot, thawed paths) are available but not the creation timestamp and user id.

0 Karma
1 Solution

woodcock
Esteemed Legend

You cannot get this information directly. You could deploy a scripted input to your indexers that does a ls -al /path/to/hot /path/to/cold but this is only going to show you that user splunk owns it. It should show you the creation date, though.

View solution in original post

0 Karma

woodcock
Esteemed Legend

You cannot get this information directly. You could deploy a scripted input to your indexers that does a ls -al /path/to/hot /path/to/cold but this is only going to show you that user splunk owns it. It should show you the creation date, though.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...