Knowledge Management

Is there a way to be able to identify the indexes that are being used by app?

aecruzp
Path Finder

good morning

    Is there a way to be able to identify the indexes that are being used by APP?., Currently we are working in a cluster but the query we have only identifies the indexes declared by app in the master server 😞

   Any help will be appreciated

regards

Labels (1)
Tags (1)
0 Karma

thebeno
Loves-to-Learn

What about this:
(oi_vmware is the index name)

| rest /servicesNS/-/-/saved/searches
| search ( search="*oi_vmware*" )
| fields title author eai:acl.app eai:acl.app request.ui_dispatch_app request.ui_dispatch_app eai:acl.sharing id

0 Karma

dkeck
Influencer

HI,

did you try this?

| rest /servicesNS/-/-/data/indexes | table title eai:acl.app

0 Karma

aecruzp
Path Finder

thanks for your answer, this query identifies the indexer.conf statement of the master server and what we need is if a user performs a query in any app using a particular index, know in which app the dashboard or .xml is created

0 Karma
Get Updates on the Splunk Community!

Splunk Certification Support Alert | Pearson VUE Outage

Splunk Certification holders and candidates!  Please be advised of an upcoming system maintenance period for ...

Enterprise Security Content Update (ESCU) | New Releases

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...