List of index available to your role Fun Stuff & Helpful Hints/ splunkd masdeeper 1 Comment Vote Up +7 Vote Down -0You already voted! |tstats count WHERE index=* OR index=_ BY index Don’t forget time modifier is required Share This: Tagged: indexes
Dave Safian April 18, 2018 at 9:33 am I prefer this query for efficiency. Substitute list of indexers into the query. | eventcount summarize=false index=* | search server= | dedup index | fields index | sort index Reply
I prefer this query for efficiency. Substitute list of indexers into the query.
| eventcount summarize=false index=* | search server= | dedup index | fields index | sort index