topic Re: How to list defined sourcetypes through API in Getting Data In

How to list defined sourcetypes through API

jbanker — Tue, 13 Aug 2019 19:09:59 GMT

I am looking for a way to list all defined sourcetypes on a Splunk server, using the REST API.

From what little information I can find, it looks like it would be possible to crawl through the configuration files and look for defined sourcetypes, but I'm hoping there is an easier way.

Re: How to list defined sourcetypes through API

traxxasbreaker — Tue, 13 Aug 2019 20:34:17 GMT

From the search bar, try something like this as a starting point:

| rest /servicesNS/-/-/configs/conf-props

Note that if you are in a distributed environment, you might have to specify a splunk_server in your REST call to look at the part of the environment that your sourcetype is defined on (such as an indexer or heavy forwarder).

If you want to look at it from the CLI instead, you would do something like this:

curl -k -u : https://splunkHost:8089/services/configs/conf-props

Re: How to list defined sourcetypes through API

jbanker — Wed, 14 Aug 2019 14:16:38 GMT

So, it looks like this can give me the sourcetypes that are currently in use by the configured inputs. Unfortunately as I stated, I'm looking to get a list of ALL configured sourcetypes available on a server. What I'm hoping to get is a list similar to what can be seen in the UI when you navigate to "Settings > Source types" or "https://splunkHost/en-US/manager/launcher/sourcetypes"

Re: How to list defined sourcetypes through API

jbanker — Wed, 14 Aug 2019 17:40:45 GMT

So, I found my own answer. For anyone looking to solve this same problem in the future, I used:

https://splunkHost:8089/services/saved/sourcetypes?output_mode=json&count=1000

This gives a nice JSON parseable output of all the defined sourcetypes for a specific instance.