Splunk Search

How do we find events on indexers wise in splunk

Path Finder

Hi Community,

I was trying to get the event details of all the indexes wise in splunk but i couldn't. please help me out on this


Labels (1)
0 Karma

Super Champion

In this case, you should look into all the sources that will have user information.

if you are not sure of sources where and all user information would be available then you should run search index=* usernameformat1 OR usernameformatinemail OR usernameformat2

different sources will record username in different formats for example windows authentication you might see just username but email logs will have email address rather username. So you should run a search specifying all formats of username in search.

you can’t use meta search the one you shared above. That will only look at meta fields source,sourcetype, index and _time and host. That will not give info inside the event.

If this helps, give a like below.
0 Karma


Could you please more specific about what you are trying to do?  What information about indexes and/or events do you seek?

If this reply helps you, Karma would be appreciated.
0 Karma

Path Finder


I want to see the total event count by indexers. i was using the below query but the results are varying.


| tstats count where index=* groupby index

0 Karma

Path Finder


Here is the small scenario where you can help us on the issue. 

One of our employee is going to be terminated on Monday so we Need to get a logging report of that employee. what are all applications that employee usually logging on daily basis. I would requesting you to help us on this.


0 Karma
Get Updates on the Splunk Community!

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...