Splunk Search

Export list of files being indexed into Splunk

efelder0
Communicator

Is there a way (Splunk feature or search cmd) to export a list of files that were indexed and then create a report?

Tags (1)
1 Solution

Ayn
Legend

You can use metadata and grab the sources from there:

| metadata type=sources

View solution in original post

Ayn
Legend

You can use metadata and grab the sources from there:

| metadata type=sources

Ayn
Legend

... | eval recentTime=strftime(recentTime,"%+")

0 Karma

efelder0
Communicator

Yes, that works. Here is my search string:
| metadata type=sources index=* | sort +source | table recentTime source

However, 'recentTime' is in this format: 1335274216
best way to convert it to MM/DD/YY HH:MM:SS ??

0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...