Splunk Search

is there a rest query I can use to identify all logfiles being monitored in an index, or all indexes?

vincenp2
New Member

If I use the query
index=* source=* | dedup source | table index source
this appears to provide me with a list of all indexes and associated sources

I am trying to find all logfiles monitored in my splunk environment and which indexes are storing the information

is the query above good enough, or is there a better way of gathering this information?

0 Karma
1 Solution

adonio
SplunkTrust
SplunkTrust

many ways to look at this, one of them is the one you mentioned.
can you be more specific regarding your use case? what exactly are you trying to achieve here?

try those searches:

| rest /services/data/inputs/all
| table title source sourcetype index

| tstats min(_time) as first_time max(_time) as last_time where index=* by index source

hope it helps

View solution in original post

0 Karma

hagjos43
Contributor

I modified this query slightly:

| tstats latest(_time) as Latest where index!=_internal by host sourcetype index 
| eval current=now() 
| eval Minimum_Age=round(((current-Latest)/60)/60,2) 
| rangemap field=Minimum_Age default=Critical Normal=0-0.5 Elevated=0.5-2 Warning=2-4
| eval stIDX=tostring(index) + " -- " + tostring(sourcetype)
| stats values(stIDX) as "Index -- Sourcetype" list(Latest) as "Latest Event" list(Minimum_Age) as Minimum_Age list(range) as Threshold by host 
| convert ctime("Latest Event") 
| eventstats avg(Minimum_Age) as average by host 
| eval average=round(average,2) 
| sort - average
| rename Minimum_Age as "Hours Since Last Communication" average as "Average Time in Hours Since Last Communication"
0 Karma

adonio
SplunkTrust
SplunkTrust

many ways to look at this, one of them is the one you mentioned.
can you be more specific regarding your use case? what exactly are you trying to achieve here?

try those searches:

| rest /services/data/inputs/all
| table title source sourcetype index

| tstats min(_time) as first_time max(_time) as last_time where index=* by index source

hope it helps

View solution in original post

0 Karma

hagjos43
Contributor

I went ahead and modified this as well to clean it up a bit (assuming you don't want internal indexes, or all individual file names):

 | rest /services/data/inputs/all
 | search index!=_*
 | stats values(sourcetype) by index
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!