Splunk Search

I'm being audited. Can i give my auditor a list of hosts and the indexes their data is in?

Splunk Employee
Splunk Employee

An auditor is requesting that we furnish them with a list of all servers logging to splunk and the index they are being written to. Is there an easy way to do this other then running through the Hosts.data files by hand?

Tags (2)
1 Solution

SplunkTrust
SplunkTrust

I would run

| metadata index="foo" type=hosts | outputcsv foo_hosts

for each index that could contain host indexed data.

View solution in original post

SplunkTrust
SplunkTrust

I would run

| metadata index="foo" type=hosts | outputcsv foo_hosts

for each index that could contain host indexed data.

View solution in original post

Splunk Employee
Splunk Employee

Thanks.. i figured that one out while you were posting. Splunk Answers--from the keyboard directly to my mind.

0 Karma