Splunk Enterprise

| rest /services/data/indexes only return event indexes

schose
Builder

Hi all,

can anyone confirm the behaviour?

when running:

| rest /services/data/indexes | table title *datatype*

I'm only getting back event indexes. From the documentation :
https://docs.splunk.com/Documentation/Splunk/8.0.0/RESTREF/RESTintrospect
datatype = The type of index (event | metric).

i would expect to get all indexes back with datatype set. 

I've tested with v8.0.7 and v8.2.0. Looks like a bug? What would be alternatives to determine the type of an index programatically from outside using the API?

best regards,

Andreas
 

Labels (1)
0 Karma
1 Solution

burwell
SplunkTrust
SplunkTrust

Hi @schose I verified on 8.1.3 and yes my metrics index didn't get returned with

| rest /services/data/indexes/

but did when I added the index name.

Looks like you did hit a bug. You should submit this as a bug to Splunk. Thanks!

View solution in original post

Tags (1)
0 Karma

schose
Builder

hi,

looks like when you are using the more specific endpoint you are getting the information. 

| rest /services/data/indexes/mtest | table *title* *type*

good enough for me, but /services/data/indexes still not looking fine. 

regards,

Andreas

0 Karma

burwell
SplunkTrust
SplunkTrust

Hi @schose I verified on 8.1.3 and yes my metrics index didn't get returned with

| rest /services/data/indexes/

but did when I added the index name.

Looks like you did hit a bug. You should submit this as a bug to Splunk. Thanks!

Tags (1)
0 Karma

schose
Builder

Hi @burwell .. thx for verification.. I'll do. 

0 Karma

schose
Builder

Hi all,

 

@Martin_Doering solved it. 

| rest /services/data/indexes datatype=all |table title *type*

works like a shame!

Regards,

 

Andreas

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...