3

Using this search command

| eventcount summarize=false | dedup index | fields index

I get a list of all indexes I have access to in Splunk. Is it also possible to get another column besides this within which the source for the index is visible too?

EDIT: It seems like I found a solution:

| tstats count WHERE index=* sourcetype=* source=* by index, sourcetype, source | fields - count

This gives back a list with columns for indexes, sourcetypes and sources.

Tobitor
  • 1,388
  • 1
  • 23
  • 58

1 Answers1

0

In case the permissions to read sources are not enforced by the tstats, you can join to your original query with an inner join on index, to limit to the indexes that you can see:

| tstats count WHERE index=* OR index=_* by index source 
| dedup index source | fields index source 
| join type=inner index [| eventcount summarize=false | dedup index | fields index]
Mads Hansen
  • 63,927
  • 12
  • 112
  • 147