is there a rest query I can use to identify all logfiles being monitored in an index, or all indexes?

[vincenp2]

If I use the query
index=* source=* | dedup source | table index source
this appears to provide me with a list of all indexes and associated sources

I am trying to find all logfiles monitored in my splunk environment and which indexes are storing the information

is the query above good enough, or is there a better way of gathering this information?

[hagjos43]

I modified this query slightly:

| tstats latest(_time) as Latest where index!=_internal by host sourcetype index 
| eval current=now() 
| eval Minimum_Age=round(((current-Latest)/60)/60,2) 
| rangemap field=Minimum_Age default=Critical Normal=0-0.5 Elevated=0.5-2 Warning=2-4
| eval stIDX=tostring(index) + " -- " + tostring(sourcetype)
| stats values(stIDX) as "Index -- Sourcetype" list(Latest) as "Latest Event" list(Minimum_Age) as Minimum_Age list(range) as Threshold by host 
| convert ctime("Latest Event") 
| eventstats avg(Minimum_Age) as average by host 
| eval average=round(average,2) 
| sort - average
| rename Minimum_Age as "Hours Since Last Communication" average as "Average Time in Hours Since Last Communication"

[adonio · Accepted solution]

many ways to look at this, one of them is the one you mentioned.
can you be more specific regarding your use case? what exactly are you trying to achieve here?

try those searches:

| rest /services/data/inputs/all
| table title source sourcetype index

| tstats min(_time) as first_time max(_time) as last_time where index=* by index source

hope it helps

[hagjos43]

I went ahead and modified this as well to clean it up a bit (assuming you don't want internal indexes, or all individual file names):

 | rest /services/data/inputs/all
 | search index!=_*
 | stats values(sourcetype) by index