Is there a way (Splunk feature or search cmd) to export a list of files that were indexed and then create a report?
You can use metadata
and grab the sources from there:
| metadata type=sources
You can use metadata
and grab the sources from there:
| metadata type=sources
... | eval recentTime=strftime(recentTime,"%+")
Yes, that works. Here is my search string:
| metadata type=sources index=* | sort +source | table recentTime source
However, 'recentTime' is in this format: 1335274216
best way to convert it to MM/DD/YY HH:MM:SS ??