Can you use the metadata command over all indexes?

[Marinus]

If I use the metadata command it only gives me keys for the main index, can I call it for other indexes? For example

index=* | metadata type=sources | search totalCount

[Ayn · Accepted solution]

Yes and no. You can specify which index metadata is to operate on, but not by specifying index=<index> before metadata (it needs to the first command of a search). Rather you need to specify the index as a parameter to metadata:

| metadata index=<index> type=sources

More information on the metadata command is available here: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Metadata

[Marinus]

Thanks Ayn RTFM!

| metadata index=* type=sources | search totalCount