Splunk Search

Export list of files being indexed into Splunk

efelder0
Communicator

Is there a way (Splunk feature or search cmd) to export a list of files that were indexed and then create a report?

Tags (1)
1 Solution

Ayn
Legend

You can use metadata and grab the sources from there:

| metadata type=sources

View solution in original post

Ayn
Legend

You can use metadata and grab the sources from there:

| metadata type=sources

Ayn
Legend

... | eval recentTime=strftime(recentTime,"%+")

0 Karma

efelder0
Communicator

Yes, that works. Here is my search string:
| metadata type=sources index=* | sort +source | table recentTime source

However, 'recentTime' is in this format: 1335274216
best way to convert it to MM/DD/YY HH:MM:SS ??

0 Karma
Get Updates on the Splunk Community!

Fall Into Learning with New Splunk Education Courses

Every month, Splunk Education releases new courses to help you branch out, strengthen your data science roots, ...

Super Optimize your Splunk Stats Searches: Unlocking the Power of tstats, TERM, and ...

By Martin Hettervik, Senior Consultant and Team Leader at Accelerate at Iver, Splunk MVPThe stats command is ...

How Splunk Observability Cloud Prevented a Major Payment Crisis in Minutes

Your bank's payment processing system is humming along during a busy afternoon, handling millions in hourly ...