Splunk Enterprise

| rest /services/data/indexes only return event indexes

schose
Builder

Hi all,

can anyone confirm the behaviour?

when running:

| rest /services/data/indexes | table title *datatype*

I'm only getting back event indexes. From the documentation :
https://docs.splunk.com/Documentation/Splunk/8.0.0/RESTREF/RESTintrospect
datatype = The type of index (event | metric).

i would expect to get all indexes back with datatype set. 

I've tested with v8.0.7 and v8.2.0. Looks like a bug? What would be alternatives to determine the type of an index programatically from outside using the API?

best regards,

Andreas
 

Labels (1)
0 Karma
1 Solution

burwell
SplunkTrust
SplunkTrust

Hi @schose I verified on 8.1.3 and yes my metrics index didn't get returned with

| rest /services/data/indexes/

but did when I added the index name.

Looks like you did hit a bug. You should submit this as a bug to Splunk. Thanks!

View solution in original post

Tags (1)
0 Karma

schose
Builder

hi,

looks like when you are using the more specific endpoint you are getting the information. 

| rest /services/data/indexes/mtest | table *title* *type*

good enough for me, but /services/data/indexes still not looking fine. 

regards,

Andreas

0 Karma

burwell
SplunkTrust
SplunkTrust

Hi @schose I verified on 8.1.3 and yes my metrics index didn't get returned with

| rest /services/data/indexes/

but did when I added the index name.

Looks like you did hit a bug. You should submit this as a bug to Splunk. Thanks!

Tags (1)
0 Karma

schose
Builder

Hi @burwell .. thx for verification.. I'll do. 

0 Karma

schose
Builder

Hi all,

 

@Martin_Doering solved it. 

| rest /services/data/indexes datatype=all |table title *type*

works like a shame!

Regards,

 

Andreas

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...