List of the indexes that do not have attached a self-storage

[esteban593]

Hi,

I'm trying to get a query for a table containing all the indexes that do not have a self storage attached, but I couldn't find anything useful. Does anyone has an idea of how to do it?

Thanks!

[richgalloway]

What do you mean by "do not have a self storage attached"?  What problem are you trying to solve?

[esteban593]

With that I mean by that are indexes which do not have an S3 bucket attached for backup. When you go to Settings > Indexes and the list is displayed, there's a column called "Self storage".

I want to configure a dashboard that displays all the indexes without self storage attached.

[richgalloway · Accepted solution]

Thanks for clarifying.  I take it this is on Splunk Cloud.  Try this query

| rest splunk_server=local /services/cluster_blaster_indexes/sh_indexes_manager 
| search * 
| where isnull(archiver.selfStorageProvider) 
| table title *self*

[esteban593]

Thanks! This works wonders