<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Query to list All indexes and sourcetypes of All Apps present in an instance in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Query-to-list-All-indexes-and-sourcetypes-of-All-Apps-present-in/m-p/535568#M89822</link>
    <description>&lt;P&gt;Hi, I'm also new, I don't know if what I'm going to answer is helpful, I'll still try&lt;/P&gt;&lt;P&gt;&lt;BR /&gt;index=* |stats count by index sourcetype app |sort -count&lt;/P&gt;</description>
    <pubDate>Tue, 12 Jan 2021 22:11:20 GMT</pubDate>
    <dc:creator>splunkcol</dc:creator>
    <dc:date>2021-01-12T22:11:20Z</dc:date>
    <item>
      <title>Query to list All indexes and sourcetypes of All Apps present in an instance</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Query-to-list-All-indexes-and-sourcetypes-of-All-Apps-present-in/m-p/535538#M89817</link>
      <description>&lt;P&gt;I need help to find a query that can list every source types and indexes of each and every app present in the search head or an instance. Is it possible to get the results using SPL?&lt;/P&gt;</description>
      <pubDate>Tue, 12 Jan 2021 18:38:35 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Query-to-list-All-indexes-and-sourcetypes-of-All-Apps-present-in/m-p/535538#M89817</guid>
      <dc:creator>rizshez</dc:creator>
      <dc:date>2021-01-12T18:38:35Z</dc:date>
    </item>
    <item>
      <title>Re: Query to list All indexes and sourcetypes of All Apps present in an instance</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Query-to-list-All-indexes-and-sourcetypes-of-All-Apps-present-in/m-p/535568#M89822</link>
      <description>&lt;P&gt;Hi, I'm also new, I don't know if what I'm going to answer is helpful, I'll still try&lt;/P&gt;&lt;P&gt;&lt;BR /&gt;index=* |stats count by index sourcetype app |sort -count&lt;/P&gt;</description>
      <pubDate>Tue, 12 Jan 2021 22:11:20 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Query-to-list-All-indexes-and-sourcetypes-of-All-Apps-present-in/m-p/535568#M89822</guid>
      <dc:creator>splunkcol</dc:creator>
      <dc:date>2021-01-12T22:11:20Z</dc:date>
    </item>
    <item>
      <title>Re: Query to list All indexes and sourcetypes of All Apps present in an instance</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Query-to-list-All-indexes-and-sourcetypes-of-All-Apps-present-in/m-p/535690#M89842</link>
      <description>&lt;P&gt;What I am trying to achieve is get list of all sourcetypes and indexes of TA. By that I mean what sourcetype and indexes is that specific TA is using.&lt;/P&gt;</description>
      <pubDate>Wed, 13 Jan 2021 17:28:32 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Query-to-list-All-indexes-and-sourcetypes-of-All-Apps-present-in/m-p/535690#M89842</guid>
      <dc:creator>rizshez</dc:creator>
      <dc:date>2021-01-13T17:28:32Z</dc:date>
    </item>
  </channel>
</rss>

