List of Indexes

This simple Splunk query will return results for indexes that the current user (typically you) have access to:

*NOTE* depending on settings this may or may not return internal indexes.

host=* | dedup index |table index
Share This:


  1. Sebastian Rauhala

    tstats is also a good option.

    | tstats latest(_time) as _time count where index=* OR index_* earliest=-24h latest=now by index, sourcetype, source, host

Leave A Comment?