Deployment Architecture

Why am I only getting results from the main index instead of all indexes when using the dbinspect command?

ltrand
Contributor

So, when I try to do a straight |dbinspect, I only get results for main instead of for all indexes. This is the same on the search head as it is on the index directly. Any thoughts on where I need to start to get the data? I'm trying to figure out better bucket rotation, but I can't do that unless I can evaluate the buckets.

Thanks everyone!

Tags (3)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi strand,

well the docs http://docs.splunk.com/Documentation/Splunk/6.3.1/SearchReference/Dbinspect are pretty straight forward on this:

index
Syntax: index=<string>
Description: Specify a name of an index to inspect. This option can be repeated for more indexes, and accepts wildcards such as asterisk ( * ) for all non-internal indexes.
Default: The default index, which is typically main.

If you want all available indexes to be shown, run this:

| dbinspect index=*

Hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi strand,

well the docs http://docs.splunk.com/Documentation/Splunk/6.3.1/SearchReference/Dbinspect are pretty straight forward on this:

index
Syntax: index=<string>
Description: Specify a name of an index to inspect. This option can be repeated for more indexes, and accepts wildcards such as asterisk ( * ) for all non-internal indexes.
Default: The default index, which is typically main.

If you want all available indexes to be shown, run this:

| dbinspect index=*

Hope this helps ...

cheers, MuS

View solution in original post

ltrand
Contributor

Thanks for the clarification, I wasn't reading the documentation right on that.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!