Deployment Architecture

Why am I only getting results from the main index instead of all indexes when using the dbinspect command?

ltrand
Contributor

So, when I try to do a straight |dbinspect, I only get results for main instead of for all indexes. This is the same on the search head as it is on the index directly. Any thoughts on where I need to start to get the data? I'm trying to figure out better bucket rotation, but I can't do that unless I can evaluate the buckets.

Thanks everyone!

Tags (3)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi strand,

well the docs http://docs.splunk.com/Documentation/Splunk/6.3.1/SearchReference/Dbinspect are pretty straight forward on this:

index
Syntax: index=<string>
Description: Specify a name of an index to inspect. This option can be repeated for more indexes, and accepts wildcards such as asterisk ( * ) for all non-internal indexes.
Default: The default index, which is typically main.

If you want all available indexes to be shown, run this:

| dbinspect index=*

Hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi strand,

well the docs http://docs.splunk.com/Documentation/Splunk/6.3.1/SearchReference/Dbinspect are pretty straight forward on this:

index
Syntax: index=<string>
Description: Specify a name of an index to inspect. This option can be repeated for more indexes, and accepts wildcards such as asterisk ( * ) for all non-internal indexes.
Default: The default index, which is typically main.

If you want all available indexes to be shown, run this:

| dbinspect index=*

Hope this helps ...

cheers, MuS

ltrand
Contributor

Thanks for the clarification, I wasn't reading the documentation right on that.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...