Why does the following search not return a list of my indexes?

[asturt]

| REST /services/data/indexes

The search shown above is supposed to return a list of all my indexes. It doesn't. I have an index that has 54,000+ events for the last fifteen minutes alone, but it is not included in the list coming back from the rest call.

Am I doing something wrong?

[JeffBothel]

The below link is what I have saved for answering this question and seems to work pretty well for me:

https://answers.splunk.com/answers/39370/is-it-possibl-to-get-a-list-of-available-indices.html

[Vijeta]

Are you running rest command on your indexer or Search head? If running on search head and index is on indexer , you might not be having the privilege to get data using REST from another server except localhost

[asturt]

Well, that's an excellent question, Vijeta. I thought I was running it against the head, but that might be a false assumption. I'll have to check with our admin to find out.

[somesoni2]

It returns list of index that the user running above search has access to. Check the role of user running this search to see if that indexes is accessible to user.

[asturt]

I am the user running the report, and it doesn't show all the indexes I can search.

[vinaykata]

have you tried the basic searches

index="" OR index="_" | dedup index | table index

[asturt]

Well, that works if I change index="" OR index="_" into index="", but the rest service also provides statistics like totalEventCount. At least, it *should provide those, but all of that information seems to be incorrect.