topic Can you help me in Identifying metadata? in Getting Data In

Can you help me in Identifying metadata?

adamfrisbee — Mon, 14 Jan 2019 16:33:21 GMT

In the Splunk documentation for events, it lists this mock event

172.26.34.223 - - [01/Jul/2017:12:05:27 -0700] "GET /trade/app?action=logout HTTP/1.1" 200 2953

I need help identifying the host, source, and source type of this event. I can identify the host as 172.26.34.223, the timestamp as [01/Jul/2017:12:05:27 -0700 and I believe the source here is GET /trade/app?action=logout HTTP/1.1 but what is the source type?

Re: Can you help me in Identifying metadata?

somesoni2 — Mon, 14 Jan 2019 20:45:37 GMT

Those metadata fields are defined at data input level (host/source/sourcetype/index etc). When you setup your data monitoring, that's when you'd specify them OR default values are taken. See this for more details:
https://docs.splunk.com/Documentation/Splunk/7.2.3/Data/Aboutdefaultfields

Re: Can you help me in Identifying metadata?

dkeck — Tue, 15 Jan 2019 06:40:03 GMT

Hi,

in your search app you can identify your sourcetype in the field section left of your event. Sourcetype should be a selected field by default, if not, you can find it further down in alphabetical order in Interesting Fields.

Re: Can you help me in Identifying metadata?

nikita_p — Tue, 15 Jan 2019 09:22:42 GMT

Hi,
I believe that source you have indexed the data, if yes then you will find host, source and sourcetype in your all fields or you can also run the following search to find source or sourcetypes
| tstats values(source) where index = * by index OR | tstats values(sourcetype) where index = * by index