SPL

List of index available to your role

Fun Stuff & Helpful Hints splunkd

Description

Submitted by masdeeper

7 0

|tstats count WHERE index=* OR index=_ BY index

Don't forget time modifier is required

Comments

1 total

DA

Dave Safian

4/18/2018

I prefer this query for efficiency. Substitute list of indexers into the query.\r\n\r\n| eventcount summarize=false index=* | search server= | dedup index | fields index | sort index

Leave a comment

You must log in to post a comment.