I'm being audited. Can i give my auditor a list of hosts and the indexes their data is in?

[Michael_Wilde]

An auditor is requesting that we furnish them with a list of all servers logging to splunk and the index they are being written to. Is there an easy way to do this other then running through the Hosts.data files by hand?

[muebel · Accepted solution]

I would run

| metadata index="foo" type=hosts | outputcsv foo_hosts

for each index that could contain host indexed data.

[Michael_Wilde]

Thanks.. i figured that one out while you were posting. Splunk Answers--from the keyboard directly to my mind.