How can I see which directories the splunk query is searching through while its running?

[EricLloyd79]

Is there a way to view the directories that a Splunk Query is searching through as it hunts through events? I recall someone mentioning turning on DEBUG mode which I did but didnt see anything in the logs defining which directories were looked through.

Thanks

[woodcock]

Why would you ever care?

[MuS]

Hi EricLloyd79,

yes and no, you can see the bucket ID but not the path. Try this run everywhere SPL which facilitates the Splunk internal field _cd ( that represents the bucket id and an address that provides the exact location of the event within its bucket) :

index=* earliest=-24h@h
| rex field=_cd "(?<bucketID>\d+)" 
| eval idx_bucketID=index .":". bucketID 
| stats count by idx_bucketID

This will give you a list of all buckets searched for each index, and since bucket ID's are uniq and are located in a known directory you can easily find them.

Hope this helps ...

cheers, MuS

UPDATE:
You could also use the _bkt field, but this will also not provide the full path. See more here http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usedefaultfields#_bkt