Splunk Search

How do we find events on indexers wise in splunk

Path Finder

Hi Community,

I was trying to get the event details of all the indexes wise in splunk but i couldn't. please help me out on this


Labels (1)
0 Karma

Super Champion

In this case, you should look into all the sources that will have user information.

if you are not sure of sources where and all user information would be available then you should run search index=* usernameformat1 OR usernameformatinemail OR usernameformat2

different sources will record username in different formats for example windows authentication you might see just username but email logs will have email address rather username. So you should run a search specifying all formats of username in search.

you can’t use meta search the one you shared above. That will only look at meta fields source,sourcetype, index and _time and host. That will not give info inside the event.

If this helps, give a like below.
0 Karma


Could you please more specific about what you are trying to do?  What information about indexes and/or events do you seek?

If this reply helps you, Karma would be appreciated.
0 Karma

Path Finder


I want to see the total event count by indexers. i was using the below query but the results are varying.


| tstats count where index=* groupby index

0 Karma

Path Finder


Here is the small scenario where you can help us on the issue. 

One of our employee is going to be terminated on Monday so we Need to get a logging report of that employee. what are all applications that employee usually logging on daily basis. I would requesting you to help us on this.


0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...