List of all indexes containing access logs

[bl]

Hello all, and thanks for the assistance ahead of time. How can I produce a list of all Splunk index names for indexes in my enterprise Splunk Cloud that contain web access log data? Is there a way to do it without scanning all indexes and inspecting data in each one to figure it out?

[bl]

That's the piece I don't know. Is there an attribute or metadata on an index that says "this index contains web access logs"? I know that choice is made when the index is created; I figured it would be exposed or queryable.

[richgalloway · Accepted solution]

An index is just a bucket into which one dumps data.  There is no attribute that says "this index contains web access logs".  Even when an index is created, there is no specification of what will go into it other than events or metrics.  The data going into an index can change so having such a label would be challenging to manage.

If your data is labeled by sourcetype then you may be in luck.  You can list which indexes contain which sourcetypes using a query like this one.

| tstats count where index=* by index,sourcetype | fields - count

Or, if you know the exact sourcetype then

| tstats count where index=* sourcetype=foo by index | fields - count

[richgalloway]

What identifies web access log data in your Splunk environment?