How to find origin of an index?


The instruction came from on-high to clean up indexes, now I'm going through and noticing indexes that I have not created.

Is there a way to tell who created a specific index?

0 Karma

Splunk Employee
Splunk Employee

Hi @stcrispan ,

Did you have a chance to check out @HiroshiSatoh answer? If it worked, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help you.

Thanks for posting!

0 Karma


You can use this search to get index information.

| rest /services/data/indexes
| rest splunk_server=(your indexser) /services/data/indexes
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...