Splunk Search

Learning my Companies Splunk Data

MScottFoley
Path Finder

I am trying to better learn what data is in the indexes at my company.   There is a command that gives you something like a summary of an index (or index and source type), but I forget that it is called.  I do not want to create a summary index, yet that is all I can find when I search.  

The command better shows what appears in the left hand side (Interesting Fields) after a search.   You can filter it and do other things to give a better understanding of the data. 

Thanks, 

P.S.

I would also be interested in any ideas people may have for learning the data at a new company.  I am a power user, not admin.  I found a query to list all indexes and one to list details of all alerts.   Is there a way to search all dashboards or display all searches in them?     

 

Labels (1)
Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Perhaps you're thinking of the fieldsummary command (https://docs.splunk.com/Documentation/Splunk/8.2.0/SearchReference/Fieldsummary).

You can use REST to search dashboards 

| rest /services/data/ui/views splunk_server=local | table eai:acl.app label title eai:data

I like to make a list of available sourcetypes when I'm learning what data is available.

| metadata type=sourcetypes index=* | table sourcetype
---
If this reply helps you, Karma would be appreciated.

View solution in original post

MScottFoley
Path Finder

fieldsummary was what I was looking for.  Also thanks for the other two searches.   

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Perhaps you're thinking of the fieldsummary command (https://docs.splunk.com/Documentation/Splunk/8.2.0/SearchReference/Fieldsummary).

You can use REST to search dashboards 

| rest /services/data/ui/views splunk_server=local | table eai:acl.app label title eai:data

I like to make a list of available sourcetypes when I'm learning what data is available.

| metadata type=sourcetypes index=* | table sourcetype
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...