Splunk Search

What is the best way to get list of index in my splunk

ma_anand1984
Contributor

Currently i'm running this command for 2 days, it takes quite a lot of time

index=* | stats count by index

Is there a better to get list of index? Since its like a table created in splunk. it should be fairly easy to get it some other way.

Tags (2)
1 Solution

ma_anand1984
Contributor

refer: http://splunk-base.splunk.com/answers/39370/is-it-possibl-to-get-a-list-of-available-indices



| eventcount summarize=false index=* index=_* | dedup index | fields index

View solution in original post

jcorcoran508
Path Finder

This spl strings worked on instance. Thank you for sharing
index=* | stats count by index
| rest /services/data/indexes
| eventcount summarize=false index=* index=_* | dedup index | fields index

0 Karma

tompai
New Member

Settings -> Indexes ?

0 Karma

ma_anand1984
Contributor

refer: http://splunk-base.splunk.com/answers/39370/is-it-possibl-to-get-a-list-of-available-indices



| eventcount summarize=false index=* index=_* | dedup index | fields index

Ayn
Legend

You can get all kinds of info about your indexes by hitting the REST endpoint data/indexes:

| rest /services/data/indexes

sloshburch
Splunk Employee
Splunk Employee

Thank you for the rest command! I hadn't thought of that and that contains so much of the data I've been looking for.

DUThibault
Contributor

How do you use this in, say, a custom app's input panel? If I try running the 'rest /services/data/indexes' search, I get "No results found", even with the time set to "All time". Like for mendesjo, 'eventcount' reports "No results found".

0 Karma

mendesjo
Path Finder

| eventcount summarize=false index= index=_ | dedup index | fields index

doesn't work I get "no results found"

0 Karma

ma_anand1984
Contributor

Thanks ayn for the quick reply. I was looking for the answer mentioned in
http://splunk-base.splunk.com/answers/39370/is-it-possibl-to-get-a-list-of-available-indices
I should have checked it before posting this question

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...