Can you use the metadata command over all indexes?

Question

If I use the metadata command it only gives me keys for the main index, can I call it for other indexes? For example

index=* | metadata type=sources | search totalCount

Accepted Answer

3

Yes and no. You can specify which index metadata is to operate on, but not by specifying index=<index> before metadata (it needs to the first command of a search). Rather you need to specify the index as a parameter to metadata:

| metadata index=<index> type=sources

More information on the metadata command is available here: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Metadata

link

answered 16 Aug '11, 06:06

Ayn
9.6k●1●3●15
accept rate: 38%

Thanks Ayn RTFM!

| metadata index=* type=sources | search totalCount

(18 Aug '11, 02:09) Marinus

Can you use the metadata command over all indexes?

Follow this question

Splunk Resources

Related questions