@Commvault The API is returning volume:hotwarm/... instead of an absolute filesystem path because your index is defined using volume references in indexes.conf. Splunk does not expand those into full paths unless the volume stanza itself has an absolute path configured. you can combine the two REST endpoints (/services/data/indexes and /services/data/index-volumes) to show full path. Try something below, | rest /services/data/indexes
| fields title homePath_expanded coldPath_expanded
| rex field=homePath_expanded "(?<homeVol>volume:[^/]+)"
| rex field=coldPath_expanded "(?<coldVol>volume:[^/]+)"
| join type=left homeVol [ | rest /services/data/index-volumes | fields title volume_path | rename title as homeVol volume_path as homeBase ]
| join type=left coldVol [ | rest /services/data/index-volumes | fields title volume_path | rename title as coldVol volume_path as coldBase ]
| eval homePathResolved=replace(homePath_expanded,homeVol,homeBase)
| eval coldPathResolved=replace(coldPath_expanded,coldVol,coldBase)
| table title homePathResolved coldPathResolved Regards, Prewin 🌟If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!
... View more