I am wondering how the "Indexes" page under Settings is generated. Is there a way that I can pull the same information that is contained there without doing a search/summation over all of my data? This page loads instantly, so I assume it isn't performing any sort of search, and I'd like to use some of the information (like total index size, number of events, etc) in other places.
Start by running the below search
|rest/servicesNS/nobody/search/data/indexes
You can some of the stuff like this:
|rest/services/properties/indexes
|rest/servicesNS/-/search/data/indexes
But to get every bit of usage stuff, you may need to mine the internal/introspection indices like DMC and SoS do. I would download those apps and take a look at their dashboards (in xml) and you should be able to copy the code directly from there and use it as-is (except for those that use data created by the SoS TA).
https://splunkbase.splunk.com/app/748/
http://docs.splunk.com/Documentation/Splunk/6.2.3/Admin/ConfiguretheMonitoringConsole
Start by running the below search
|rest/servicesNS/nobody/search/data/indexes
So it looks like almost everything I need is there, but I'm still missing some useful info. Is there a quick way to get the time information, (like first event, latest event) without performing a search over the whole index? This info is loaded instantly on the settings page, I figured it must be stored as metadata somewhere. The time info would be extremely helpful in identifying when data stops coming in to particular indexes.
Excellent, I figured it was something simple. Thanks!