refer: http://splunk-base.splunk.com/answers/39370/is-it-possibl-to-get-a-list-of-available-indices
| eventcount summarize=false index=* index=_* | dedup index | fields index
This spl strings worked on instance. Thank you for sharing
index=* | stats count by index
| rest /services/data/indexes
| eventcount summarize=false index=* index=_* | dedup index | fields index
Settings -> Indexes ?
refer: http://splunk-base.splunk.com/answers/39370/is-it-possibl-to-get-a-list-of-available-indices
| eventcount summarize=false index=* index=_* | dedup index | fields index
You can get all kinds of info about your indexes by hitting the REST endpoint data/indexes
:
| rest /services/data/indexes
Thank you for the rest command! I hadn't thought of that and that contains so much of the data I've been looking for.
How do you use this in, say, a custom app's input panel? If I try running the 'rest /services/data/indexes' search, I get "No results found", even with the time set to "All time". Like for mendesjo, 'eventcount' reports "No results found".
| eventcount summarize=false index= index=_ | dedup index | fields index
doesn't work I get "no results found"
Thanks ayn for the quick reply. I was looking for the answer mentioned in
http://splunk-base.splunk.com/answers/39370/is-it-possibl-to-get-a-list-of-available-indices
I should have checked it before posting this question