Is it possible to get the list of all indexes along with the userID who has created that index with the time of creation?
I have tried with | rest /services/data/indexes, where index details (cold, hot, thawed paths) are available but not the creation timestamp and user id.
You cannot get this information directly. You could deploy a scripted input
to your indexers that does a ls -al /path/to/hot /path/to/cold
but this is only going to show you that user splunk
owns it. It should show you the creation date, though.
You cannot get this information directly. You could deploy a scripted input
to your indexers that does a ls -al /path/to/hot /path/to/cold
but this is only going to show you that user splunk
owns it. It should show you the creation date, though.