When I run the following command to list the indexes on my indexers, I only see the top 30 per indexer:
| rest /services/data/indexes
How can I see all my indexes using this command?
According to the docs,
| rest /services/data/indexes count=0
OR
https://indexer:8089/services/data/indexes?count=-1
The docs mention that the default for the rest
search command is 0, i.e. unlimited. For the REST API, however the documented default is 30 (and -1 is what you set for 'unlimited').
As I have less than 30 indexes, I cannot verify this.
Hope this helps,
/K
According to the docs,
| rest /services/data/indexes count=0
OR
https://indexer:8089/services/data/indexes?count=-1
The docs mention that the default for the rest
search command is 0, i.e. unlimited. For the REST API, however the documented default is 30 (and -1 is what you set for 'unlimited').
As I have less than 30 indexes, I cannot verify this.
Hope this helps,
/K
/services/data/indexes is not listing the metrics indexes
In order to get metrics index info also:
| rest /services/data/indexes count=0 datatype=all
I found this answer first, and then found it here: https://answers.splunk.com/answers/10237/getting-splunk-api-to-return-more-than-30-deployment-client...
I was not able to find documentation of the "-1". Thank you!