indexes dataset function

Use the indexes() function to search event indexes that you have permission to access.

This function can't be used with metric indexes. However, you can use the union command to merge metric and event index datasets. See Merge datasets using the union command.

Syntax

The required syntax is in bold.

indexes(<patterns>)

Required arguments

The required arguments for the indexes() function depends on the syntax that you use:

Syntax	Description
indexes()	Use this syntax to search your default event indexes, such as main.
indexes('*')	Use this syntax to search all of the event indexes you have access to. This syntax does not return internal indexes.
indexes('_*')	Use this syntax to search all of the internal event indexes you have access to.
indexes(<index-name>...)	Use this syntax to search specific event indexes. You must specify at least one index name. Separate multiple index names with commas. You can also name function arguments. See Examples.

Usage

You can use this function with any generating command, such as the from, join, and union commands.

You can use a wildcard to specify similarly named indexes. You must enclose indexes specified with the asterisk wildcard in single quotation marks. See Examples.

Examples

These examples show different ways you can use the indexes function to search the event indexes you have access to.

1. Retrieve data from your default indexes

| FROM indexes()

2. Retrieve data from all of the indexes you have access to

When you specify a wildcard, you must enclose the asterisk in single quotation marks.

| FROM indexes('*')

3. Retrieve data from a group of similarly named indexes

When you specify a set of indexes using a wildcard, you must enclose the name and wildcard in single quotation marks.

| FROM indexes('data*')

4. Naming function arguments

Naming arguments is optional. In the following example, the argument name patterns is used before the group of similarly named indexes 'data1*' and 'data2*' . When you specify multiple patterns, you must enclose the list of patterns in square brackets and separate the the items with commas.

| FROM indexes(patterns: ['data1*', 'data2*'])

5. Merge datasets using the union command

Use the union command to merge the results from multiple datasets. By default the union command interleaves the results in descending time order.

| union indexes(webtraffic, 'webdata*')

This search merges the results from these indexes:

• The index webtraffic
• All indexes that start with webdata

You can't use the indexes function with indexes that have a dataset kind of metrics. You must specify metrics indexes separately from event indexes. For example:

| union indexes(webtraffic, 'webdata*'), metrics: "webmetrics"

This search merges the results from these indexes:

• The index webtraffic
• All indexes that start with webdata
• The metrics index webmetrics

6. Combine datasets using the join command

Use the join command to combine the results from multiple datasets.

This search joins the logons index with all of the indexes that start with logonData. This search uses an inner join. The indexes are joined on the id field.

| FROM logons | join type=inner max=0 left=L right=R where L.id=R.id indexes('logonData*')

See also

Function information

Overview of SPL2 dataset_functions

Naming function arguments in the SPL2 Search Manual