Is it possible to get a list of available indices?

[flo_cognosec]

I could then populate a dropdown list with indices 🙂

Somehow I could not get this done, would be cool if somebody could help me 🙂

I would prefer some in-splunk possibilities compared to file-parsing or CLI foo btw out of obv. reasons.

[jkat54]

Except that it doesn't apply RBAC view of the indexes.

Except that it doesn't work if you can't reach indexers on 8089 and don't have indexes configured on your SH.

Except that it's not as fast as eventcount and probably shouldn't be used in dashboard drop downs.

[flo_cognosec]

I now hardcoded the index names in a StaticSelect for performance reasons ^^ Technically not pretty but efficient and solves my problem 🙂

[inventsekar]

old post,... but,... may i know whats "StaticSelect" (if its still not deprecated)

[gkanapathy]

It is not correct that you will only see local indexes. the eventcount command will return all indexes that can be searched, local or remote distributed ones. But yes, it will only list ones that are accessible to the running user. It is true that Splunk's UI, API, and Management GUI does not provide a way to bypass security restrictions to allow people to list indexes they do not have access to.

[rtadams89]

This will not work. Such a search will only return events indexed locally, and therefore you have the potential to miss a bunch of indexes.

index=* | dedup index | fields index

run over all time

Would be better (in terms of getting all a complete list of indexes), but is not very efficient, it will only show indexes the person running the search has access to.

I don't believe Splunk has a reliable way to get a list of all current indexes through the web GUI (even the management section can be lacking in certain cases).

[dkikan]

this does not work. I think the key is using eventcount with summarize=false

[gkanapathy]

Sorry, my mistake. You need to add 'index=*' as an argument to the summarize command, as draineh did.

[Drainy]

Gkanapathy is quite right, my search would be rubbish! @flo_cognosec, the search you need is;
| eventcount summarize=false index=* | dedup index | fields index

[flo_cognosec]

This does not give me a list of all available indices, just the ones I set up to be searched by default or am I missing something ?

[Drainy]

Have you had a look at the UI Examples app?
http://splunk-base.splunk.com/apps/22333/splunk-ui-examples-app-for-41

That has some good drop down search examples, so you could just build a drop down form dashboard where the drop down is populated with the results of something like index=* and choose the index fields to get the data.

[manikdham]

is it possible to exclude some indexes of the list

[flo_cognosec]

Thanks, sometimes you just overlook the obvious 😕