https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-the-sources-from-soucetype/m-p/346982#M102737 <P>Hi kteng2024, You might find <CODE>tstats</CODE> would work better here. i.e.</P> <PRE><CODE>| tstats count where sourcetype=YOUR_SOURCETYPE by source </CODE></PRE> <P>This will give you a list sources for that sourcetype. It should be fairly quick to run over large timeframes.</P> <P>Please let me know if this answers your question! <span class="lia-unicode-emoji" title=":grinning_face_with_smiling_eyes:">😄</span></P> Mon, 13 Mar 2017 18:57:52 GMT muebel 2017-03-13T18:57:52Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-the-sources-from-soucetype/m-p/346981#M102736 <P>Hi,</P> <P>I am using the following search <CODE>| metadata type=sourcetype| where match(sources)</CODE> to find all the sources that a particular sourcetype has. Can someone please help in the correcting the search?</P> Mon, 13 Mar 2017 18:44:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-the-sources-from-soucetype/m-p/346981#M102736 kteng2024 2017-03-13T18:44:03Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-the-sources-from-soucetype/m-p/346982#M102737 <P>Hi kteng2024, You might find <CODE>tstats</CODE> would work better here. i.e.</P> <PRE><CODE>| tstats count where sourcetype=YOUR_SOURCETYPE by source </CODE></PRE> <P>This will give you a list sources for that sourcetype. It should be fairly quick to run over large timeframes.</P> <P>Please let me know if this answers your question! <span class="lia-unicode-emoji" title=":grinning_face_with_smiling_eyes:">😄</span></P> Mon, 13 Mar 2017 18:57:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-the-sources-from-soucetype/m-p/346982#M102737 muebel 2017-03-13T18:57:52Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-the-sources-from-soucetype/m-p/346983#M102738 <P>You need another <CODE>s</CODE> for starters but you cannot do what you are trying to do with the command that you are trying to use. See what I mean with these:</P> <PRE><CODE>| metadata type=sources index=* OR index=_* | metadata type=sourcetypes index=* OR index=_* </CODE></PRE> <P>But you can do it with <CODE>tstats</CODE> like this:</P> <PRE><CODE> | tstats values(source) WHERE index=* OR index=_* BY sourcetype </CODE></PRE> Mon, 13 Mar 2017 19:05:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-the-sources-from-soucetype/m-p/346983#M102738 woodcock 2017-03-13T19:05:06Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-the-sources-from-soucetype/m-p/346984#M102739 <P>If you're collecting data for all sourcetypes then use this variation.</P> <PRE><CODE>| tstats max(_time) as recentTime where index=* by sourcetype source </CODE></PRE> Mon, 13 Mar 2017 19:05:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-the-sources-from-soucetype/m-p/346984#M102739 somesoni2 2017-03-13T19:05:11Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-the-sources-from-soucetype/m-p/346985#M102740 <P>Try<BR /> | metadata type=sources sourcetype=*</P> Tue, 14 Mar 2017 13:19:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-the-sources-from-soucetype/m-p/346985#M102740 mgrosholz 2017-03-14T13:19:53Z