Splunk Search

How do we find events on indexers wise in splunk

Path Finder

Hi Community,

I was trying to get the event details of all the indexes wise in splunk but i couldn't. please help me out on this


Labels (1)
0 Karma

Super Champion

In this case, you should look into all the sources that will have user information.

if you are not sure of sources where and all user information would be available then you should run search index=* usernameformat1 OR usernameformatinemail OR usernameformat2

different sources will record username in different formats for example windows authentication you might see just username but email logs will have email address rather username. So you should run a search specifying all formats of username in search.

you can’t use meta search the one you shared above. That will only look at meta fields source,sourcetype, index and _time and host. That will not give info inside the event.

If this helps, give a like below.
0 Karma


Could you please more specific about what you are trying to do?  What information about indexes and/or events do you seek?

If this reply helps you, Karma would be appreciated.
0 Karma

Path Finder


I want to see the total event count by indexers. i was using the below query but the results are varying.


| tstats count where index=* groupby index

0 Karma

Path Finder


Here is the small scenario where you can help us on the issue. 

One of our employee is going to be terminated on Monday so we Need to get a logging report of that employee. what are all applications that employee usually logging on daily basis. I would requesting you to help us on this.


0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...