Splunk Search
Highlighted

Is it possibl to get a list of available indices ?

Communicator

I could then populate a dropdown list with indices 🙂

Somehow I could not get this done, would be cool if somebody could help me 🙂

I would prefer some in-splunk possibilities compared to file-parsing or CLI foo btw out of obv. reasons.

Tags (3)
Highlighted

Re: Is it possibl to get a list of available indices ?

Champion

Have you had a look at the UI Examples app?
http://splunk-base.splunk.com/apps/22333/splunk-ui-examples-app-for-41

That has some good drop down search examples, so you could just build a drop down form dashboard where the drop down is populated with the results of something like index=* and choose the index fields to get the data.

Highlighted

Re: Is it possibl to get a list of available indices ?

Communicator

Thanks, sometimes you just overlook the obvious 😕

0 Karma
Highlighted

Re: Is it possibl to get a list of available indices ?

Path Finder

is it possible to exclude some indexes of the list

0 Karma
Highlighted

Re: Is it possibl to get a list of available indices ?

Legend

The most efficient way to get accurate results is probably:

| eventcount summarize=false index=* | dedup index | fields index

Just searching for index=* could be inefficient and wrong, e.g., if one index contains billions of events in the last hour, but another's most recent data is back just before midnight, you would either miss out on the second index, or have to retrieve all billions of events just to discover it.

Update:

Corrected to include index=*.
If you want to include internal indexes, you can use:

| eventcount summarize=false index=* index=_* | dedup index | fields index

View solution in original post

Highlighted

Re: Is it possibl to get a list of available indices ?

Communicator

This does not give me a list of all available indices, just the ones I set up to be searched by default or am I missing something ?

0 Karma
Highlighted

Re: Is it possibl to get a list of available indices ?

Champion

Gkanapathy is quite right, my search would be rubbish! @flo_cognosec, the search you need is;
| eventcount summarize=false index=* | dedup index | fields index

0 Karma
Highlighted

Re: Is it possibl to get a list of available indices ?

Legend

Sorry, my mistake. You need to add 'index=*' as an argument to the summarize command, as draineh did.

0 Karma
Highlighted

Re: Is it possibl to get a list of available indices ?

Contributor

This will not work. Such a search will only return events indexed locally, and therefore you have the potential to miss a bunch of indexes.

index=* | dedup index | fields index

run over all time

Would be better (in terms of getting all a complete list of indexes), but is not very efficient, it will only show indexes the person running the search has access to.

I don't believe Splunk has a reliable way to get a list of all current indexes through the web GUI (even the management section can be lacking in certain cases).

0 Karma
Highlighted

Re: Is it possibl to get a list of available indices ?

Engager

this does not work. I think the key is using eventcount with summarize=false

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.