How do I search for a list of the most searched indexes and the count for each?

[rameshlpatel]

Hi,

I am looking for a list of the most searched indexes and the count for each. Is it possible to get that in Splunk?

Can someone please share a search for that?

[somesoni2 · Accepted solution]

Something like this can get you started

index=_audit action=*search*  search_id=* | table _time search  splunk_server | rex field=search "index\s*=\s*(?<IndexName>\w+)" | stats count by IndexName splunk_server

[ppablo]

Hi @rameshlpatel

Can you clarify if you're looking for a list of the most searched indexers or most searched indexes? You put "indexes list" in your title but "indexer list" in your content.

[rameshlpatel]

My Bad. most searched indexes .

[ppablo]

No problem, thanks for clarifying!