Splunk® Cloud Services

SPL2 Search Reference

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

indexes dataset function

Use the indexes() function to search event indexes that you have permission to access.

This function cannot be used with metric indexes.

Syntax

The required syntax is in bold.

indexes(<patterns>)

Required arguments

The required arguments for the indexes() function depends on the syntax that you use:

Syntax Description
indexes() Use this syntax to search your default event indexes, such as main.
indexes('*') Use this syntax to search all of the event indexes you have access to. This syntax does not return internal indexes.
indexes('_*') Use this syntax to search all of the internal event indexes you have access to.
indexes(<index-name>...) Use this syntax to search specific event indexes. You must specify at least one index name. Separate multiple index names with commas. You can also name function arguments. See Examples.

Usage

You can use this function with any generating command, such as the from, join, and union commands.

You can use a wildcard to specify similarly named indexes. You must enclose indexes specified with the asterisk wildcard in single quotation marks. See Examples.

To use named arguments, you must specify the values in an array, enclosing the values in square brackets. The syntax for named arguments is indexes(patterns: [<value1>, <value2>,...]. For example:

...indexes(patterns: [webtraffic, 'webdata*'])

See "Naming function arguments" in Overview of SPL2 dataset functions.

Examples

These examples show different ways you can use the indexes function to search the event indexes you have access to.

1. Retrieve data from your default indexes

| FROM indexes()

2. Retrieve data from all of the indexes you have access to

When you specify a wildcard, you must enclose the asterisk in single quotation marks.

| FROM indexes('*')

3. Retrieve data from a group of similarly named indexes

When you specify a set of indexes using a wildcard, you must enclose the name and wildcard in single quotation marks.

| FROM indexes('data*')

4. Naming function arguments

Naming arguments is optional. In the following example, the argument name patterns is used before the group of similarly named indexes 'data1*' and 'data2*' . When you specify multiple patterns, you must enclose the list of patterns in square brackets and separate the the items with commas.

| FROM indexes(patterns: ['data1*', 'data2*'])


4. Merge datasets using the union command

Use the union command to merge the results from multiple datasets. By default the union command interleaves the results in descending time order.

| union indexes(webtraffic, 'webdata*')

This search merges the results from these indexes:

  • The index webtraffic
  • All indexes that start with webdata

You can't use the indexes function with indexes that have a dataset kind of metrics. You must specify metrics indexes separately from event indexes. For example:

| union indexes(webtraffic, 'webdata*'), metrics: "webmetrics"

This search merges the results from these indexes:

  • The index webtraffic
  • All indexes that start with webdata
  • The metrics index webmetrics

6. Combine datasets using the join command

Use the join command to combine the results from multiple datasets.

This search joins the logons index with all of the indexes that start with logonData. This search uses an inner join. The indexes are joined on the id field.

| FROM logons | join type=inner max=0 left=L right=R where L.id=R.id indexes('logonData*')

Last modified on 20 October, 2020
PREVIOUS
Overview of SPL2 dataset functions
  NEXT
repeat dataset function

This documentation applies to the following versions of Splunk® Cloud Services: current


Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters