Splunk Enterprise

How to find the index for the apps assigned in server class

YungLee
Engager

Hi all, I would like to ask this.

 

So for example I assigned app1 and app2 into a server class.

How can I find out the index that app1 and app2 use.

 

I know the alternative way is to look through the file system > etc > Deployment App > local  > index=test

But is there a way to find out the index, without going into the machine file system or CLI.

 

Thank you for any help provided.

Labels (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

I'm afraid that there is no easy and 100% way to get this information as out of box.

What you could try if you have 9.x.x. UF on place is just query from _configtracker index. But you should remember that there is only information what has changed.

Maybe better way is just add a new app which monitor those inputs.conf files on UF side and send that information to another index on your servers?

r. Ismo

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...