topic Re: listdown the sourcetype from the index in Getting Data In

listdown the sourcetype from the index

splunkpoornima — Tue, 04 Dec 2012 10:28:13 GMT

Hi all

i used the below code..to list down the sourcetype of the main indx in the dropdown ..

sources

| metadata type=sourcetype index=main

please correct me if i made an mistake..

thanks in advance

Re: listdown the sourcetype from the index

Ayn — Tue, 04 Dec 2012 10:29:40 GMT

type=sourcetype is incorrect, it should be type=sourcetypes.

PLEASE PLEASE consult the docs as a first resort.

Re: listdown the sourcetype from the index

splunkpoornima — Tue, 04 Dec 2012 10:43:49 GMT

no actually i used type=sourcetypes only but when typing here i missed

Re: listdown the sourcetype from the index

Ayn — Tue, 04 Dec 2012 10:45:19 GMT

Other errors include: it's populatingSearch, not populatingsearch. It's sourcetype, not SourceType.

Re: listdown the sourcetype from the index

splunkpoornima — Tue, 04 Dec 2012 11:12:39 GMT

actually i changed everything u said..after runing the code..i got got the error as

Error in 'search' command: Unable to parse the search: Comparator '=' is missing a term on the right hand side.

Re: listdown the sourcetype from the index

Ayn — Tue, 04 Dec 2012 11:44:04 GMT

Doesn't sound like a problem in the dropdown.

Re: listdown the sourcetype from the index

Drainy — Tue, 04 Dec 2012 11:44:42 GMT

That sounds like you have a space somewhere you shouldn't, could you edit your question with the updated xml?

Re: listdown the sourcetype from the index

splunkpoornima — Tue, 04 Dec 2012 12:21:40 GMT

finnaly i got the output.now the problem is, i created two dropdowns one for sourcetypes so if i select source type i want the ist of sources in that sourcetype

| metadata type=sourcetypes index="main"

sources $tokenusedindropdown$