Splunk Search

What is the best way to get list of index in my splunk

ma_anand1984
Contributor

Currently i'm running this command for 2 days, it takes quite a lot of time

index=* | stats count by index

Is there a better to get list of index? Since its like a table created in splunk. it should be fairly easy to get it some other way.

Tags (2)
1 Solution

ma_anand1984
Contributor

refer: http://splunk-base.splunk.com/answers/39370/is-it-possibl-to-get-a-list-of-available-indices



| eventcount summarize=false index=* index=_* | dedup index | fields index

View solution in original post

jcorcoran508
Path Finder

This spl strings worked on instance. Thank you for sharing
index=* | stats count by index
| rest /services/data/indexes
| eventcount summarize=false index=* index=_* | dedup index | fields index

0 Karma

tompai
New Member

Settings -> Indexes ?

0 Karma

ma_anand1984
Contributor

refer: http://splunk-base.splunk.com/answers/39370/is-it-possibl-to-get-a-list-of-available-indices



| eventcount summarize=false index=* index=_* | dedup index | fields index

Ayn
Legend

You can get all kinds of info about your indexes by hitting the REST endpoint data/indexes:

| rest /services/data/indexes

sloshburch
Splunk Employee
Splunk Employee

Thank you for the rest command! I hadn't thought of that and that contains so much of the data I've been looking for.

DUThibault
Contributor

How do you use this in, say, a custom app's input panel? If I try running the 'rest /services/data/indexes' search, I get "No results found", even with the time set to "All time". Like for mendesjo, 'eventcount' reports "No results found".

0 Karma

mendesjo
Path Finder

| eventcount summarize=false index= index=_ | dedup index | fields index

doesn't work I get "no results found"

0 Karma

ma_anand1984
Contributor

Thanks ayn for the quick reply. I was looking for the answer mentioned in
http://splunk-base.splunk.com/answers/39370/is-it-possibl-to-get-a-list-of-available-indices
I should have checked it before posting this question

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...