Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- REST /services/data/indexes: How can I see all my ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When I run the following command to list the indexes on my indexers, I only see the top 30 per indexer:
| rest /services/data/indexes
How can I see all my indexes using this command?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
According to the docs,
| rest /services/data/indexes count=0
OR
https://indexer:8089/services/data/indexes?count=-1
The docs mention that the default for the rest search command is 0, i.e. unlimited. For the REST API, however the documented default is 30 (and -1 is what you set for 'unlimited').
As I have less than 30 indexes, I cannot verify this.
Hope this helps,
/K
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
According to the docs,
| rest /services/data/indexes count=0
OR
https://indexer:8089/services/data/indexes?count=-1
The docs mention that the default for the rest search command is 0, i.e. unlimited. For the REST API, however the documented default is 30 (and -1 is what you set for 'unlimited').
As I have less than 30 indexes, I cannot verify this.
Hope this helps,
/K
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
/services/data/indexes is not listing the metrics indexes
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In order to get metrics index info also:
| rest /services/data/indexes count=0 datatype=all- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I found this answer first, and then found it here: https://answers.splunk.com/answers/10237/getting-splunk-api-to-return-more-than-30-deployment-client...
I was not able to find documentation of the "-1". Thank you!
If this reply helps you, an upvote would be appreciated.
Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...
Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...
Reduce and Transform Your Firewall Data with Splunk Data Management
