Dashboards & Visualizations

how to pull the index and app\workspace names on Splunk search heads?

yu94
New Member

Hi,

Can you please help me to write a query to run on the search heads which will list me the index and app\workspace names in a tabular format?

It would be even helpful if you can write a query to display like these are the indexes in this App\Workspace.

This is basically to give an idea to a new user to get started.. If i can build a dashboard which will list out the list of indexes in each workspace it would help them to identify their workspace\app and indexes in it.

Thanks,
Thippesh

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi yu94,

as admin user you can run this search:

| rest /servicesNS/-/-/data/indexes
| table title eai:acl.app 
| rename "eai:acl.app" AS app title AS index 
| stats count values(index) AS index by app

to get a table of indexes per app.
If you don't have the admin role assigned, ask your friendly Splunk admin to create a saved search and report/dashboard for you.

Hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...