Indexes in Splunk

For those who have more than a few indexes (we’ve got 27 non-administrative indexes) I wrote this search so people could figure-out what we have and what it is used for. The search requires that there be a file called indexdescriptions.csv located in $SPLUNK_HOME/etc/apps/search/lookups (or “Program Files”\splunk\etc\apps\search\lookups\indexdescriptions.csv ). That file should have “index,description” on the first line, then nameofindex,free-form description of the index on each subsequent line. You can try the search without that by removing the lookup line and removing the ‘description’ field from the fields command on the last line.

Share This:

Leave A Comment?