Splunk Search

List of all indexes containing access logs

bl
Engager

Hello all, and thanks for the assistance ahead of time. How can I produce a list of all Splunk index names for indexes in my enterprise Splunk Cloud that contain web access log data? Is there a way to do it without scanning all indexes and inspecting data in each one to figure it out?

Labels (1)
Tags (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

An index is just a bucket into which one dumps data.  There is no attribute that says "this index contains web access logs".  Even when an index is created, there is no specification of what will go into it other than events or metrics.  The data going into an index can change so having such a label would be challenging to manage.

If your data is labeled by sourcetype then you may be in luck.  You can list which indexes contain which sourcetypes using a query like this one.

 

| tstats count where index=* by index,sourcetype | fields - count

 

Or, if you know the exact sourcetype then

 

| tstats count where index=* sourcetype=foo by index | fields - count

 

 

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

bl
Engager

That's the piece I don't know. Is there an attribute or metadata on an index that says "this index contains web access logs"? I know that choice is made when the index is created; I figured it would be exposed or queryable.

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

An index is just a bucket into which one dumps data.  There is no attribute that says "this index contains web access logs".  Even when an index is created, there is no specification of what will go into it other than events or metrics.  The data going into an index can change so having such a label would be challenging to manage.

If your data is labeled by sourcetype then you may be in luck.  You can list which indexes contain which sourcetypes using a query like this one.

 

| tstats count where index=* by index,sourcetype | fields - count

 

Or, if you know the exact sourcetype then

 

| tstats count where index=* sourcetype=foo by index | fields - count

 

 

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

What identifies web access log data in your Splunk environment?

---
If this reply helps you, an upvote would be appreciated.
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!