How to get the details of index name and who has created it ?

[gndivya]

Is it possible to get the list of all indexes along with the userID who has created that index with the time of creation?
I have tried with | rest /services/data/indexes, where index details (cold, hot, thawed paths) are available but not the creation timestamp and user id.

[woodcock · Accepted solution]

You cannot get this information directly. You could deploy a scripted input to your indexers that does a ls -al /path/to/hot /path/to/cold but this is only going to show you that user splunk owns it. It should show you the creation date, though.