Knowledge Management

Is there a way to be able to identify the indexes that are being used by app?

aecruzp
Path Finder

good morning

    Is there a way to be able to identify the indexes that are being used by APP?., Currently we are working in a cluster but the query we have only identifies the indexes declared by app in the master server 😞

   Any help will be appreciated

regards

Tags (1)
0 Karma

thebeno
Explorer

What about this:
(oi_vmware is the index name)

| rest /servicesNS/-/-/saved/searches
| search ( search="*oi_vmware*" )
| fields title author eai:acl.app eai:acl.app request.ui_dispatch_app request.ui_dispatch_app eai:acl.sharing id

0 Karma

dkeck
Influencer

HI,

did you try this?

| rest /servicesNS/-/-/data/indexes | table title eai:acl.app

0 Karma

aecruzp
Path Finder

thanks for your answer, this query identifies the indexer.conf statement of the master server and what we need is if a user performs a query in any app using a particular index, know in which app the dashboard or .xml is created

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...