Getting Data In

How can I duplicate the "Indexes" settings page?

adam_reber
Path Finder

I am wondering how the "Indexes" page under Settings is generated. Is there a way that I can pull the same information that is contained there without doing a search/summation over all of my data? This page loads instantly, so I assume it isn't performing any sort of search, and I'd like to use some of the information (like total index size, number of events, etc) in other places.

Tags (1)
0 Karma
1 Solution

pradeepkumarg
Influencer

Start by running the below search

|rest/servicesNS/nobody/search/data/indexes

View solution in original post

woodcock
Esteemed Legend

You can some of the stuff like this:

|rest/services/properties/indexes
|rest/servicesNS/-/search/data/indexes

But to get every bit of usage stuff, you may need to mine the internal/introspection indices like DMC and SoS do. I would download those apps and take a look at their dashboards (in xml) and you should be able to copy the code directly from there and use it as-is (except for those that use data created by the SoS TA).

https://splunkbase.splunk.com/app/748/
http://docs.splunk.com/Documentation/Splunk/6.2.3/Admin/ConfiguretheMonitoringConsole

0 Karma

pradeepkumarg
Influencer

Start by running the below search

|rest/servicesNS/nobody/search/data/indexes

adam_reber
Path Finder

So it looks like almost everything I need is there, but I'm still missing some useful info. Is there a quick way to get the time information, (like first event, latest event) without performing a search over the whole index? This info is loaded instantly on the settings page, I figured it must be stored as metadata somewhere. The time info would be extremely helpful in identifying when data stops coming in to particular indexes.

0 Karma

adam_reber
Path Finder

Excellent, I figured it was something simple. Thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...