Splunk Search

What is the best way to get list of index in my splunk

ma_anand1984
Contributor

Currently i'm running this command for 2 days, it takes quite a lot of time

index=* | stats count by index

Is there a better to get list of index? Since its like a table created in splunk. it should be fairly easy to get it some other way.

Tags (2)
1 Solution

ma_anand1984
Contributor

refer: http://splunk-base.splunk.com/answers/39370/is-it-possibl-to-get-a-list-of-available-indices



| eventcount summarize=false index=* index=_* | dedup index | fields index

View solution in original post

jcorcoran508
Path Finder

This spl strings worked on instance. Thank you for sharing
index=* | stats count by index
| rest /services/data/indexes
| eventcount summarize=false index=* index=_* | dedup index | fields index

0 Karma

tompai
New Member

Settings -> Indexes ?

0 Karma

ma_anand1984
Contributor

refer: http://splunk-base.splunk.com/answers/39370/is-it-possibl-to-get-a-list-of-available-indices



| eventcount summarize=false index=* index=_* | dedup index | fields index

Ayn
Legend

You can get all kinds of info about your indexes by hitting the REST endpoint data/indexes:

| rest /services/data/indexes

sloshburch
Splunk Employee
Splunk Employee

Thank you for the rest command! I hadn't thought of that and that contains so much of the data I've been looking for.

DUThibault
Contributor

How do you use this in, say, a custom app's input panel? If I try running the 'rest /services/data/indexes' search, I get "No results found", even with the time set to "All time". Like for mendesjo, 'eventcount' reports "No results found".

0 Karma

mendesjo
Path Finder

| eventcount summarize=false index= index=_ | dedup index | fields index

doesn't work I get "no results found"

0 Karma

ma_anand1984
Contributor

Thanks ayn for the quick reply. I was looking for the answer mentioned in
http://splunk-base.splunk.com/answers/39370/is-it-possibl-to-get-a-list-of-available-indices
I should have checked it before posting this question

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...