List indexes on the main dashboard
| Topics: | hacks, tech |
|---|---|
| Tags: | 40 days of Splunk 4.0, dashboards |
| Share: |
If you are comfortable editing XML, here’s a handy hack to get the list of your default indexes in the “All indexed data” dashboard. It will show whatever the logged-in user has access to.
If you are using the standard dashboards from the Search app, do this:
Go to $SPLUNK_HOME/etc/apps/search/default/data/ui/views
Copy dashboard.xml to $SPLUNK_HOME/etc/apps/search/local/data/ui/views
Change the permissions on the file so you can edit it
Right before the last </view> tag at the end insert this XML:
<module name="HiddenSearch" layoutPanel="panel_row2_col1_grp4" group="All
indexed data" autoRun="True">
<param name="search">| eventcount summarize=false index=* -count</param>
<module name="SimpleResultsHeader">
<param name="entityName">results</param>
<param name="headerFormat">Indexes (%(count)s)</param>
<module name="Paginator">
<param name="count">20</param>
<param name="entityName">results</param>
<param name="maxPages">10</param>
<module name="LinkList">
<param name="initialSortDir">desc</param>
<param name="labelFieldSearch">*</param>
<param name="valueField">count</param>
<param name="labelField">index</param>
<param name="labelFieldTarget">flashtimeline</param>
<param name="initialSort">count</param>
</module>
</module>
</module>
</module>
Save the file.
Back in the UI, click the Splunk logo to refresh the search app.
Presto! Now there is a new column showing indexes. If something didn’t work right, just remove the file you created. This file won’t be overwritten on upgrade, so if in the future there is a change to the search app you will still have this version because files in local take precedence.

September 23rd, 2009 at 9:19 am
This is a great