Splunk Search

Can you use the metadata command over all indexes?

Communicator

If I use the metadata command it only gives me keys for the main index, can I call it for other indexes? For example

index=* | metadata type=sources | search totalCount
Tags (1)
0 Karma
1 Solution

Legend

Yes and no. You can specify which index metadata is to operate on, but not by specifying index=<index> before metadata (it needs to the first command of a search). Rather you need to specify the index as a parameter to metadata:

| metadata index=<index> type=sources

More information on the metadata command is available here: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Metadata

View solution in original post

Legend

Yes and no. You can specify which index metadata is to operate on, but not by specifying index=<index> before metadata (it needs to the first command of a search). Rather you need to specify the index as a parameter to metadata:

| metadata index=<index> type=sources

More information on the metadata command is available here: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Metadata

View solution in original post

Communicator

Thanks Ayn RTFM!

| metadata index=* type=sources | search totalCount

0 Karma