Splunk Search

What is the best way to get list of index in my splunk

Contributor

Currently i'm running this command for 2 days, it takes quite a lot of time

index=* | stats count by index

Is there a better to get list of index? Since its like a table created in splunk. it should be fairly easy to get it some other way.

Tags (2)
1 Solution

Contributor

refer: http://splunk-base.splunk.com/answers/39370/is-it-possibl-to-get-a-list-of-available-indices



| eventcount summarize=false index=* index=_* | dedup index | fields index

View solution in original post

Loves-to-Learn

This spl strings worked on instance. Thank you for sharing
index=* | stats count by index
| rest /services/data/indexes
| eventcount summarize=false index=* index=_* | dedup index | fields index

0 Karma

New Member

Settings -> Indexes ?

0 Karma

Contributor

refer: http://splunk-base.splunk.com/answers/39370/is-it-possibl-to-get-a-list-of-available-indices



| eventcount summarize=false index=* index=_* | dedup index | fields index

View solution in original post

Legend

You can get all kinds of info about your indexes by hitting the REST endpoint data/indexes:

| rest /services/data/indexes

Ultra Champion

Thank you for the rest command! I hadn't thought of that and that contains so much of the data I've been looking for.

Contributor

How do you use this in, say, a custom app's input panel? If I try running the 'rest /services/data/indexes' search, I get "No results found", even with the time set to "All time". Like for mendesjo, 'eventcount' reports "No results found".

0 Karma

Explorer

| eventcount summarize=false index= index=_ | dedup index | fields index

doesn't work I get "no results found"

0 Karma

Contributor

Thanks ayn for the quick reply. I was looking for the answer mentioned in
http://splunk-base.splunk.com/answers/39370/is-it-possibl-to-get-a-list-of-available-indices
I should have checked it before posting this question

0 Karma