Splunk Enterprise

| rest /services/data/indexes only return event indexes

schose
Builder

Hi all,

can anyone confirm the behaviour?

when running:

| rest /services/data/indexes | table title *datatype*

I'm only getting back event indexes. From the documentation :
https://docs.splunk.com/Documentation/Splunk/8.0.0/RESTREF/RESTintrospect
datatype = The type of index (event | metric).

i would expect to get all indexes back with datatype set. 

I've tested with v8.0.7 and v8.2.0. Looks like a bug? What would be alternatives to determine the type of an index programatically from outside using the API?

best regards,

Andreas
 

Labels (1)
0 Karma
1 Solution

burwell
SplunkTrust
SplunkTrust

Hi @schose I verified on 8.1.3 and yes my metrics index didn't get returned with

| rest /services/data/indexes/

but did when I added the index name.

Looks like you did hit a bug. You should submit this as a bug to Splunk. Thanks!

View solution in original post

Tags (1)
0 Karma

schose
Builder

hi,

looks like when you are using the more specific endpoint you are getting the information. 

| rest /services/data/indexes/mtest | table *title* *type*

good enough for me, but /services/data/indexes still not looking fine. 

regards,

Andreas

0 Karma

burwell
SplunkTrust
SplunkTrust

Hi @schose I verified on 8.1.3 and yes my metrics index didn't get returned with

| rest /services/data/indexes/

but did when I added the index name.

Looks like you did hit a bug. You should submit this as a bug to Splunk. Thanks!

View solution in original post

Tags (1)
0 Karma

schose
Builder

Hi @burwell .. thx for verification.. I'll do. 

0 Karma

schose
Builder

Hi all,

 

@Martin_Doering solved it. 

| rest /services/data/indexes datatype=all |table title *type*

works like a shame!

Regards,

 

Andreas

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!