For their names; | rest splunk_server=* /services/data/indexes | table title ... View more

If you're trying to get the captain for programatic purposes, as I am, you can either use the API, like so: curl -s -XGET -u "admin:${SPLUNK_PASSWORD}" \ "https://${SPLUNK_ENDPOINT}/services/shcluster/status?output_mode=json" | \ jq -r '.entry[0].content.captain.label' Or if you can't install jq , you can do something like: /opt/splunk/bin/splunk show shcluster-status -auth 'admin:${SPLUNK_PASSWORD}' | \ grep label | head -n1 | cut -d ":" -f2 | xargs ... View more