Getting Data In

Search that lists the configured indexes on a Splunk indexer?

Derek
Path Finder

Hi,

Is there a search that can return the list of indexes configured on a Splunk Indexer?

Or is the only way to look at the _internal index and work it out based on data that exists in that index from performance metrics etc..

Thanks!

0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

You can run | eventcount summarize=false index=* index=_*. This search actually runs distributed, but it does add a field splunk_server so you can sort or filter on that.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

You can run | eventcount summarize=false index=* index=_*. This search actually runs distributed, but it does add a field splunk_server so you can sort or filter on that.

Simeon
Splunk Employee
Splunk Employee

If you have no more than 8 indexes, you can do the following:

index=_internal source=*metrics.log* per_index_thruput | stats count by series

The above search grabs indexing metrics from the internal logs. By default, Splunk will only track the top 10 indexes including the two internal ones (_internal and _audit). If you have more than 10 indexes, you can change the metrics logging limit.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...