How do we find events on indexers wise in splunk

[mputtam]

Hi Community,

I was trying to get the event details of all the indexes wise in splunk but i couldn't. please help me out on this

Thankyou.

[thambisetty]

In this case, you should look into all the sources that will have user information.

if you are not sure of sources where and all user information would be available then you should run search index=* usernameformat1 OR usernameformatinemail OR usernameformat2

different sources will record username in different formats for example windows authentication you might see just username but email logs will have email address rather username. So you should run a search specifying all formats of username in search.

you can’t use meta search the one you shared above. That will only look at meta fields source,sourcetype, index and _time and host. That will not give info inside the event.

[richgalloway]

Could you please more specific about what you are trying to do?  What information about indexes and/or events do you seek?

[mputtam]

Hi

I want to see the total event count by indexers. i was using the below query but the results are varying.

| tstats count where index=* groupby index

[mputtam]

Hi,

Here is the small scenario where you can help us on the issue. 

One of our employee is going to be terminated on Monday so we Need to get a logging report of that employee. what are all applications that employee usually logging on daily basis. I would requesting you to help us on this.

Thanks.