Search that lists the configured indexes on a Splunk indexer?

[Derek]

Hi,

Is there a search that can return the list of indexes configured on a Splunk Indexer?

Or is the only way to look at the _internal index and work it out based on data that exists in that index from performance metrics etc..

Thanks!

[gkanapathy · Accepted solution]

You can run | eventcount summarize=false index=* index=_*. This search actually runs distributed, but it does add a field splunk_server so you can sort or filter on that.

[Simeon]

If you have no more than 8 indexes, you can do the following:

index=_internal source=*metrics.log* per_index_thruput | stats count by series

The above search grabs indexing metrics from the internal logs. By default, Splunk will only track the top 10 indexes including the two internal ones (_internal and _audit). If you have more than 10 indexes, you can change the metrics logging limit.