topic Re: How to see all source and sourcetype list in Getting Data In

How to see all source and sourcetype list

rameshlpatel — Wed, 29 Jan 2014 16:21:36 GMT

Hi,

In splunk UI, I am seeing only top 10 source and sourcetype list.

But I want to see all of them. Please suggest me on this.

Re: How to see all source and sourcetype list

tararso — Wed, 29 Jan 2014 16:35:27 GMT

to view all sources : index=* |chart count by source
to view all sourcetypes: index=* |chart count by sourcetype

Re: How to see all source and sourcetype list

rameshlpatel — Wed, 29 Jan 2014 16:41:01 GMT

For this I have to run one extra queries for finding list of all source.

there is no any way to get list from existing fired query?

Re: How to see all source and sourcetype list

somesoni2 — Wed, 29 Jan 2014 22:55:59 GMT

Use following (faster) for source

| metadata type=hosts index=* OR index=_*

for sourcetypes

| metadata type=sourcetypes index=* OR index=_*

Re: How to see all source and sourcetype list

mkinsley_splunk — Wed, 29 Jan 2014 23:07:20 GMT

the reason this is inefficient is that you are asking the system to do a full scan of the index and aggregate the count. Your poor indexers have to process every single event . |metadata is what you want.

Re: How to see all source and sourcetype list

axelabs — Wed, 09 Sep 2015 15:31:20 GMT

I believe the metadata way display's all indexed source[type]'s ever. This may not be the lightest query, but gives me recent things:
" *** | chart count by sourcetype | sort count desc** " in the past hour

Re: How to see all source and sourcetype list

saadhasankhan — Mon, 27 Jun 2016 14:21:01 GMT

I am not an expert but I got indexes, sources and sourtypes as well as a custom "Customer" field with the following query:

source=* sourcetype=* [| eventcount summarize=false index=* | table index | format "(" "" "" "" "OR" ")"] |
 fillnull value="N/A" Customer 
| stats count by index, source, sourcetype, Customer 
| sort index, source, sourcetype, Customer

Re: How to see all source and sourcetype list

davidcottrell — Thu, 06 Apr 2017 11:45:51 GMT

This does not work. You need to you source,field entries.

Re: How to see all source and sourcetype list

adonio — Thu, 06 Apr 2017 11:48:37 GMT

try this
| tstats values(source) where index = * by index

Re: How to see all source and sourcetype list

CraigAtNuna — Wed, 27 Dec 2017 17:40:35 GMT

Don't you need "index=*" and not "index="?

Re: How to see all source and sourcetype list

bharathkumarnec — Tue, 29 Sep 2020 17:26:43 GMT

Why don't you use license_usage.log file to get all the sources and sourcetypes??

index=_internal source=*license_usage.log

You will get all the data with s as source st as sourcetype, using this we can get the required information.

Re: How to see all source and sourcetype list

joechakkola1 — Tue, 13 Nov 2018 19:35:15 GMT

thank you , this query was very helpful.

Re: How to see all source and sourcetype list

wrangler2x — Tue, 05 Mar 2019 17:53:17 GMT

I like this search. If you have the OS app loaded on your instance (*nix) it has a bunch of its own sourcetypes that are not interesting, so that's why I exclude its index (os). If you don't, you can remove that last line of the search:

The output is a column of sourcetypes, with a second column of the index(es) that sourcetype is found in.

Re: How to see all source and sourcetype list

ujeshmaurya — Wed, 03 Jul 2019 06:10:41 GMT

|metadata type=sourcetypes index="index_name"

|metadata type=source index="index_name"

This works nicely

Re: How to see all source and sourcetype list

ujeshmaurya — Wed, 03 Jul 2019 06:11:29 GMT

|metadata type=sourcetypes index="index_name"

|metadata type=source index="index_name"

This will work for sure. 🙂

Re: How to see all source and sourcetype list

vijayad — Fri, 02 Aug 2019 11:51:02 GMT

Try to run below btool command and search for your sourcetype

opt/splunk/bin > ./splunk btool inputs list --debug > output.txt

Re: How to see all source and sourcetype list

sahilverma — Mon, 13 Jan 2020 16:09:17 GMT

I am looking for sourcetype for parsing .csv files.

Source is Azure mscs:storage:blob

Re: How to see all source and sourcetype list

xlash911 — Sat, 18 Jul 2020 20:54:37 GMT

All answers querying for all sources from metadata had the same typo.

Use :

|metadata type=sources index=*