How to find the list of indexes and source types in specific app?

[gokikrishnan198]

I have a different kind of access called ELEVATED ACCESS in splunk enterprise which is below the POWER USER but higher than the USER, with different apps installed. I have only one app in that. Is there a way to identify the list of available indexes and source types that is used in my app?

[renjith_nair · Accepted solution]

If you have access only to indexes under one app, then you can try

|tstats count by sourcetype where index=* |fields - count

If you need to list down app name as well, then probably need to use rest calls,for eg:

    | rest /servicesNS/-/-/data/indexes  | table title eai:acl.app

This might need additional permissions!

[gokikrishnan198]

I am able to get the few indexes from the code '|tstats count by sourcetype where index=* |fields - count' you gave. But I am unable to get the source types for the corresponding indexes. Can you help me on that part?

[renjith_nair]

@gokikrishnan1982, if you just want all indexes and sourcetypes, try

|tstats count by index,sourcetype|fields - count

[gokikrishnan198]

Thank you. It worked.

[adonio]

what do you mean by "used by the app"? do you mean configured under this app e.g. props.conf and indexes.conf and maybe other files are in that app directory? or you refer to what knowledge objects / searches are in this app?
if it is ab RBAC question, an app has no "roles" access to indexes or apps or knowledge objects can be defined per role

[gokikrishnan198]

Our Client uses splunk. All the teams have their own app available in it. We are one of the team as well. In this situation, I could like to know the steps to identify the INDEX and SOURCETYPE?

[gokikrishnan198]

Can anybody help me on this?

[adonio]

@gokikrishnan1982,
sorry but i still not sure what exactly you are looking for.
what is the problem you are trying to solve?
if you are trying to figure out which sourcetypes and indexes are being used by an app, you first have to check the searches / knowledge objects that are under that app and see what sourcetypes and indexes they are running against.
please provide more context and detail so we can better assist you
also, see answer by @renjith.nair, maybe this is what you are looking for

[gokikrishnan198]

I am given an app to work within SPLUNK.
I have neither Power User nor ** User role*. Rather I have **Elevated User* role.
I would like to know the DataSummary from where the data is getting pulled.
I would like to know the list of available Indexes and SourceTypes that are used in my app.
Do we have any query to search that information? Please assist me on the same.

[manojannabathin]

Any solution on this issue??

i would like to know which application is using which index name