topic Data/configuration report in Getting Data In

Data/configuration report

TeddyE — Wed, 30 Sep 2020 20:28:30 GMT

I am looking to create a report to show just a subset of my Universal forwarders. What I am looking for is an expansion on this that I just cannot seem to get working. Any assistance appreciated!

| tstats values(sourcetype) AS Sourcetype dc(sourcetype) AS #sourcetypes WHERE index=* by host

for just the following indexes: os, main, tomcat.

A great help would be to sort by deployment App (NIX, Unix, Linux) if possible, but I am not seeing anything in the system that shows the source of the data (which App is deployed).

Re: Data/configuration report

richgalloway — Thu, 01 Oct 2020 14:29:32 GMT

To consider only certain indexes, include those index names in the query.

| tstats values(sourcetype) AS Sourcetype dc(sourcetype) AS #sourcetypes WHERE (index=os OR index=main OR index=tomcat) by host

The tstats command doesn't have app information available in most cases as events typically do not contain that field. There are REST commands you can use to try to map sourcetype to app, but understand that there may be more than one app associated with a given sourcetype.

Re: Data/configuration report

TeddyE — Thu, 01 Oct 2020 14:34:33 GMT

Thank you that is exactly it. Appreciate the assist.