Yes you are right, I can get all of the Keys and Values by just searching "index=YourVirtualIndex". The problem is that this search command would take several minutes. I'm not interested in the events, I just want to have parts of the metadata ("sources") so I can use them as values in a checkbox on a dashbord (for example). Unfortunately like mentioned, there are no such metadata stored for virtual indexes...
One can say that I want to implement parts of the "Explore Data" feature on a dashboard. "Drilldown into HDFS Path".
Since we run on a Hunk license, we've already fully integrated Hadoop. So "Hadoop Connect" is no option for us, although the "| hdfs ls" looks like it would do the trick.
... View more