List of existing indexes

[Sailesh6891]

Is it possible to get list of all indexes with creation time and who created the index?

[inventsekar]

Hi @Sailesh6891 

To list all Splunk indexes, use the search command

1)  | metadata type=indexes 

2) | rest /services/data/indexes 

3)  | tstats count where index=* by index

4)  with web UI access available(if you have admin access), check Settings > Indexes for a managed view. 

for the question - creation time and who created the index

there are no straight forward answer for this(should check about this).  

Similar question discussed was: https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-get-a-list-of-available-indices/m-p/...

[PickleRick]

That thread is the one I took liberty of "detaching" the post from since it adds additional elements (creator and creation date) to make it unique.

[PickleRick]

There is no such thing as a general "index creation time". And the case of index creator is even more murky if you take into account that indexes can be created by simply creating a config file and restarting the service. Splunk on its own doesn't keep such info directly "attached" to the index. You could try to retrieve events regarding index creation from the _internal index but you are obviously limited to the index's retention period.