Is there a way to view the directories that a Splunk Query is searching through as it hunts through events? I recall someone mentioning turning on DEBUG mode which I did but didnt see anything in the logs defining which directories were looked through.
Thanks
Why would you ever care?
Hi EricLloyd79,
yes and no, you can see the bucket ID but not the path. Try this run everywhere SPL which facilitates the Splunk internal field _cd
( that represents the bucket id and an address that provides the exact location of the event within its bucket) :
index=* earliest=-24h@h
| rex field=_cd "(?<bucketID>\d+)"
| eval idx_bucketID=index .":". bucketID
| stats count by idx_bucketID
This will give you a list of all buckets searched for each index, and since bucket ID's are uniq and are located in a known directory you can easily find them.
Hope this helps ...
cheers, MuS
UPDATE:
You could also use the _bkt
field, but this will also not provide the full path. See more here http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usedefaultfields#_bkt