| REST /services/data/indexes
The search shown above is supposed to return a list of all my indexes. It doesn't. I have an index that has 54,000+ events for the last fifteen minutes alone, but it is not included in the list coming back from the rest call.
Am I doing something wrong?
The below link is what I have saved for answering this question and seems to work pretty well for me:
https://answers.splunk.com/answers/39370/is-it-possibl-to-get-a-list-of-available-indices.html
Are you running rest command on your indexer or Search head? If running on search head and index is on indexer , you might not be having the privilege to get data using REST from another server except localhost
Well, that's an excellent question, Vijeta. I thought I was running it against the head, but that might be a false assumption. I'll have to check with our admin to find out.
It returns list of index that the user running above search has access to. Check the role of user running this search to see if that indexes is accessible to user.
I am the user running the report, and it doesn't show all the indexes I can search.
have you tried the basic searches
index="" OR index="_" | dedup index | table index
Well, that works if I change index="" OR index="_" into index="", but the rest service also provides statistics like totalEventCount. At least, it *should provide those, but all of that information seems to be incorrect.