Deployment Architecture

Why am I only getting results from the main index instead of all indexes when using the dbinspect command?

ltrand
Contributor

So, when I try to do a straight |dbinspect, I only get results for main instead of for all indexes. This is the same on the search head as it is on the index directly. Any thoughts on where I need to start to get the data? I'm trying to figure out better bucket rotation, but I can't do that unless I can evaluate the buckets.

Thanks everyone!

Tags (3)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi strand,

well the docs http://docs.splunk.com/Documentation/Splunk/6.3.1/SearchReference/Dbinspect are pretty straight forward on this:

index
Syntax: index=<string>
Description: Specify a name of an index to inspect. This option can be repeated for more indexes, and accepts wildcards such as asterisk ( * ) for all non-internal indexes.
Default: The default index, which is typically main.

If you want all available indexes to be shown, run this:

| dbinspect index=*

Hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi strand,

well the docs http://docs.splunk.com/Documentation/Splunk/6.3.1/SearchReference/Dbinspect are pretty straight forward on this:

index
Syntax: index=<string>
Description: Specify a name of an index to inspect. This option can be repeated for more indexes, and accepts wildcards such as asterisk ( * ) for all non-internal indexes.
Default: The default index, which is typically main.

If you want all available indexes to be shown, run this:

| dbinspect index=*

Hope this helps ...

cheers, MuS

ltrand
Contributor

Thanks for the clarification, I wasn't reading the documentation right on that.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...