Hello all, and thanks for the assistance ahead of time. How can I produce a list of all Splunk index names for indexes in my enterprise Splunk Cloud that contain web access log data? Is there a way to do it without scanning all indexes and inspecting data in each one to figure it out?
An index is just a bucket into which one dumps data. There is no attribute that says "this index contains web access logs". Even when an index is created, there is no specification of what will go into it other than events or metrics. The data going into an index can change so having such a label would be challenging to manage.
If your data is labeled by sourcetype then you may be in luck. You can list which indexes contain which sourcetypes using a query like this one.
| tstats count where index=* by index,sourcetype | fields - count
Or, if you know the exact sourcetype then
| tstats count where index=* sourcetype=foo by index | fields - count
That's the piece I don't know. Is there an attribute or metadata on an index that says "this index contains web access logs"? I know that choice is made when the index is created; I figured it would be exposed or queryable.
An index is just a bucket into which one dumps data. There is no attribute that says "this index contains web access logs". Even when an index is created, there is no specification of what will go into it other than events or metrics. The data going into an index can change so having such a label would be challenging to manage.
If your data is labeled by sourcetype then you may be in luck. You can list which indexes contain which sourcetypes using a query like this one.
| tstats count where index=* by index,sourcetype | fields - count
Or, if you know the exact sourcetype then
| tstats count where index=* sourcetype=foo by index | fields - count
What identifies web access log data in your Splunk environment?