Splunk Search

How can i search what all indexes are into splunk ESS app?

rajksplunk
New Member

please let me know via CLI or Splunkweb.?

Tags (1)
0 Karma

esix_splunk
Splunk Employee
Splunk Employee

You can also use btool

./splunk btool indexes --debug

That will show the full path of the indexes.conf applied and the app it's applied from. You can pipe that to grep and search for EnterpriseSecuruty. Additionally if you're on the latest version of ES, and in a distributed environment, you can use the GUI to created the TA forindexers. Open this up and you can see the configs for indexers.

0 Karma

somesoni2
Revered Legend

How about the documentation?
http://docs.splunk.com/Documentation/ES/4.2.0/Install/Indexes#Indexes_by_app

YOu can use the following search as well (need to provide the app name)

| rest /services/data/indexes splunk_server=local | search eai:acl.app="App Name Here" | table title

rajksplunk
New Member

Thanks ! somesoni2 for responding but i found no results when i triggered search that you provided.
could help me out if any alternate ?
i can see all indexes bu using"| rest /services/data/indexes splunk_server=local |but when i tried for specific app then No Results found

0 Karma

somesoni2
Revered Legend

Check the field name in the | search (should be correct only but double check) and the app name (need the app folder name ).

OR may be just run this and check the app name.

| rest /services/data/indexes splunk_server=local  | table title eai:acl.app
0 Karma
Get Updates on the Splunk Community!

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...