topic Why does metadata command returns only one sourcetype? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Why-does-metadata-command-returns-only-one-sourcetype/m-p/499419#M85120 <P>We've got over 50 sourcetypes, however, when I run the command below, I only see syslog under the sourcetype column. </P> <PRE><CODE>| metadata type=sourcetypes | sort - totalCount </CODE></PRE> <P>Does anyone have an explanation? </P> Tue, 08 Oct 2019 21:17:08 GMT dillardo_2 2019-10-08T21:17:08Z Why does metadata command returns only one sourcetype? https://community.splunk.com/t5/Getting-Data-In/Why-does-metadata-command-returns-only-one-sourcetype/m-p/499419#M85120 <P>We've got over 50 sourcetypes, however, when I run the command below, I only see syslog under the sourcetype column. </P> <PRE><CODE>| metadata type=sourcetypes | sort - totalCount </CODE></PRE> <P>Does anyone have an explanation? </P> Tue, 08 Oct 2019 21:17:08 GMT https://community.splunk.com/t5/Getting-Data-In/Why-does-metadata-command-returns-only-one-sourcetype/m-p/499419#M85120 dillardo_2 2019-10-08T21:17:08Z Re: Why does metadata command returns only one sourcetype? https://community.splunk.com/t5/Getting-Data-In/Why-does-metadata-command-returns-only-one-sourcetype/m-p/499420#M85121 <P>It's only looking at your default index(es). Try <CODE>| metadata type=sourcetypes idnex=* | sort - totalCount</CODE>.</P> Tue, 08 Oct 2019 21:51:50 GMT https://community.splunk.com/t5/Getting-Data-In/Why-does-metadata-command-returns-only-one-sourcetype/m-p/499420#M85121 richgalloway 2019-10-08T21:51:50Z Re: Why does metadata command returns only one sourcetype? https://community.splunk.com/t5/Getting-Data-In/Why-does-metadata-command-returns-only-one-sourcetype/m-p/499421#M85122 <P>Thanks @richgalloway, this did the trick!</P> Wed, 09 Oct 2019 15:38:04 GMT https://community.splunk.com/t5/Getting-Data-In/Why-does-metadata-command-returns-only-one-sourcetype/m-p/499421#M85122 dillardo_2 2019-10-09T15:38:04Z