https://community.splunk.com/t5/Getting-Data-In/How-can-I-search-within-the-source-names-and-source-type-names/m-p/65436#M13134 <P>Wow, that works like magic, thanks!!</P> <P>One tiny typo in the second one:<BR /> match(sourcetypes,"prod")<BR /> should be<BR /> match(sourcetype,"prod")</P> <P>Thanks again!</P> Wed, 19 Sep 2012 22:44:24 GMT mdickey 2012-09-19T22:44:24Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-search-within-the-source-names-and-source-type-names/m-p/65432#M13130 <P>I'm using an existing Splunk instance that already has hundreds of sources and source types. How can I search among the source names and source type names to find sources of interest? For example, I would like to know the names of all sources that contain the string "prod" in the source name itself.</P> Wed, 19 Sep 2012 20:57:25 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-search-within-the-source-names-and-source-type-names/m-p/65432#M13130 mdickey 2012-09-19T20:57:25Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-search-within-the-source-names-and-source-type-names/m-p/65433#M13131 <P>That's easy, just search</P> <PRE><CODE>| metadata type=sources | where match(source,"prod") </CODE></PRE> <P>or</P> <PRE><CODE>| metadata type=sourcetypes | where match(sourcetype,"prod") </CODE></PRE> <P>to get just a list of the sourceytpes or sources, with a little info about each. Note that the match function uses regular expressions. To actually search the data, you can use</P> <PRE><CODE>source="*prod*" </CODE></PRE> <P>or </P> <PRE><CODE>sourcetype="*prod*" </CODE></PRE> <P>HTH</P> Wed, 19 Sep 2012 20:59:08 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-search-within-the-source-names-and-source-type-names/m-p/65433#M13131 lguinn2 2012-09-19T20:59:08Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-search-within-the-source-names-and-source-type-names/m-p/65434#M13132 <P>Sorry, I must not have explained myself well. Your suggestion will search the actual event data. I don't want to search the data. I only want to get a back a list of source names that match. I want to search this list of source names themselves, not the data in the sources.</P> Wed, 19 Sep 2012 21:24:58 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-search-within-the-source-names-and-source-type-names/m-p/65434#M13132 mdickey 2012-09-19T21:24:58Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-search-within-the-source-names-and-source-type-names/m-p/65435#M13133 <P>Updated my answer per your comments!</P> Wed, 19 Sep 2012 21:36:47 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-search-within-the-source-names-and-source-type-names/m-p/65435#M13133 lguinn2 2012-09-19T21:36:47Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-search-within-the-source-names-and-source-type-names/m-p/65436#M13134 <P>Wow, that works like magic, thanks!!</P> <P>One tiny typo in the second one:<BR /> match(sourcetypes,"prod")<BR /> should be<BR /> match(sourcetype,"prod")</P> <P>Thanks again!</P> Wed, 19 Sep 2012 22:44:24 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-search-within-the-source-names-and-source-type-names/m-p/65436#M13134 mdickey 2012-09-19T22:44:24Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-search-within-the-source-names-and-source-type-names/m-p/65437#M13135 <P>Thanks for the catch on the typo, I fixed it!</P> Wed, 19 Sep 2012 23:38:48 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-search-within-the-source-names-and-source-type-names/m-p/65437#M13135 lguinn2 2012-09-19T23:38:48Z