https://community.splunk.com/t5/Reporting/How-can-I-get-a-list-of-indexes-the-source-types-for-the-indexes/m-p/385210#M9754 <P>Do this tstats search in the UI like the other answer shows.</P> Mon, 18 Jun 2018 00:13:46 GMT jkat54 2018-06-18T00:13:46Z https://community.splunk.com/t5/Reporting/How-can-I-get-a-list-of-indexes-the-source-types-for-the-indexes/m-p/385207#M9751 <P>I am able to get a list of indexes and their source types using | metadata type=sources index=* sourcetype=* ||dedup source, but I want to add the source types to the list and be able to pick the index from a drop-down so that I get only the source types and sources for a particular index.</P> Fri, 15 Jun 2018 18:40:38 GMT https://community.splunk.com/t5/Reporting/How-can-I-get-a-list-of-indexes-the-source-types-for-the-indexes/m-p/385207#M9751 nls7010 2018-06-15T18:40:38Z https://community.splunk.com/t5/Reporting/How-can-I-get-a-list-of-indexes-the-source-types-for-the-indexes/m-p/385208#M9752 <P>Try this search over a time window long enough to get all of the possible indexes, sources, and sourcetypes. Save it to a dashboard panel:</P> <PRE><CODE>index=* | stats count by index sourcetype source </CODE></PRE> <P>Add a dropdown input to your dashboard with this configuration:<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/5200i1D45E5D537605990/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span><BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/5201i33F7B275CC150912/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>Click on the magnifying glass at the top of your dashboard panel when in Edit mode to edit the search. Modify the search to use your token for the index value:</P> <PRE><CODE>index=$myindex$ | stats count by index sourcetype source </CODE></PRE> Fri, 15 Jun 2018 19:53:57 GMT https://community.splunk.com/t5/Reporting/How-can-I-get-a-list-of-indexes-the-source-types-for-the-indexes/m-p/385208#M9752 kmorris_splunk 2018-06-15T19:53:57Z https://community.splunk.com/t5/Reporting/How-can-I-get-a-list-of-indexes-the-source-types-for-the-indexes/m-p/385209#M9753 <P>Hi @nls7010,<BR /> Try this ,</P> <PRE><CODE>|tstats count by index,source,sourcetype|fields - count </CODE></PRE> <P>if you have the index selected, then you could filter by </P> <PRE><CODE> |tstats count where index=your_selected_index by source,sourcetype|fields - count </CODE></PRE> Sat, 16 Jun 2018 04:57:23 GMT https://community.splunk.com/t5/Reporting/How-can-I-get-a-list-of-indexes-the-source-types-for-the-indexes/m-p/385209#M9753 renjith_nair 2018-06-16T04:57:23Z https://community.splunk.com/t5/Reporting/How-can-I-get-a-list-of-indexes-the-source-types-for-the-indexes/m-p/385210#M9754 <P>Do this tstats search in the UI like the other answer shows.</P> Mon, 18 Jun 2018 00:13:46 GMT https://community.splunk.com/t5/Reporting/How-can-I-get-a-list-of-indexes-the-source-types-for-the-indexes/m-p/385210#M9754 jkat54 2018-06-18T00:13:46Z https://community.splunk.com/t5/Reporting/How-can-I-get-a-list-of-indexes-the-source-types-for-the-indexes/m-p/385211#M9755 <P>Thank you for the guide below, but oddly even when I added the dropdown it's not affecting the search. This is one Panel in a dashboard, do I have to do something different to make it work there?</P> Mon, 18 Jun 2018 19:22:32 GMT https://community.splunk.com/t5/Reporting/How-can-I-get-a-list-of-indexes-the-source-types-for-the-indexes/m-p/385211#M9755 nls7010 2018-06-18T19:22:32Z https://community.splunk.com/t5/Reporting/How-can-I-get-a-list-of-indexes-the-source-types-for-the-indexes/m-p/385212#M9756 <P>Got it going, it was just a matter of my time span.</P> Mon, 18 Jun 2018 19:40:41 GMT https://community.splunk.com/t5/Reporting/How-can-I-get-a-list-of-indexes-the-source-types-for-the-indexes/m-p/385212#M9756 nls7010 2018-06-18T19:40:41Z https://community.splunk.com/t5/Reporting/How-can-I-get-a-list-of-indexes-the-source-types-for-the-indexes/m-p/385213#M9757 <P>@nls7010, if it works , please accept answer or let us know in case of further issues</P> Wed, 20 Jun 2018 08:45:29 GMT https://community.splunk.com/t5/Reporting/How-can-I-get-a-list-of-indexes-the-source-types-for-the-indexes/m-p/385213#M9757 renjith_nair 2018-06-20T08:45:29Z https://community.splunk.com/t5/Reporting/How-can-I-get-a-list-of-indexes-the-source-types-for-the-indexes/m-p/385214#M9758 <P>Thank you all for your replies. I was able to get it to work as above.</P> Mon, 12 Nov 2018 16:06:08 GMT https://community.splunk.com/t5/Reporting/How-can-I-get-a-list-of-indexes-the-source-types-for-the-indexes/m-p/385214#M9758 nls7010 2018-11-12T16:06:08Z