https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-find-the-all-the-indexes-and-their/m-p/350014#M103625 <P>Since you just want a list, no other info, you can just use the metadata.</P> <PRE><CODE> | metadata type=sourcetypes index=* OR index=_* </CODE></PRE> <HR /> <P>Please do a search before asking a simple question like this, though. Here's the first few google results:</P> <P><A href="https://answers.splunk.com/answers/120461/how-to-see-all-source-and-sourcetype-list.html">https://answers.splunk.com/answers/120461/how-to-see-all-source-and-sourcetype-list.html</A><BR /> <A href="https://answers.splunk.com/answers/2521/fastest-way-to-show-all-sources-and-sourcetypes-in-an-index.html">https://answers.splunk.com/answers/2521/fastest-way-to-show-all-sources-and-sourcetypes-in-an-index.html</A><BR /> <A href="https://answers.splunk.com/answers/69704/how-can-i-list-all-indexes-and-sourcetypes.html">https://answers.splunk.com/answers/69704/how-can-i-list-all-indexes-and-sourcetypes.html</A><BR /> <A href="https://answers.splunk.com/answers/314680/how-do-i-list-all-sourcetypes-for-each-host-per-in.html">https://answers.splunk.com/answers/314680/how-do-i-list-all-sourcetypes-for-each-host-per-in.html</A></P> Thu, 09 Mar 2017 19:34:26 GMT DalJeanis 2017-03-09T19:34:26Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-find-the-all-the-indexes-and-their/m-p/350012#M103623 <P>hi,</P> <P>i would like to know the search to find all the indexes and their sourcetypes . But my search is:</P> <PRE><CODE>index=* | dedup sourcetype | table sourcetype </CODE></PRE> <P>and i selected " ALL TIME" . So, is there any other way to find out the indexes and their sourcetypes without using a wildcard and ALL TIME? </P> Thu, 09 Mar 2017 19:11:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-find-the-all-the-indexes-and-their/m-p/350012#M103623 kteng2024 2017-03-09T19:11:37Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-find-the-all-the-indexes-and-their/m-p/350013#M103624 <P>Try this <CODE>| tstats values(sourcetype) where index=* by index</CODE></P> <P>It uses index files only, so it should complete pretty quickly without having to scan all of your data.</P> Thu, 09 Mar 2017 19:27:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-find-the-all-the-indexes-and-their/m-p/350013#M103624 s2_splunk 2017-03-09T19:27:26Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-find-the-all-the-indexes-and-their/m-p/350014#M103625 <P>Since you just want a list, no other info, you can just use the metadata.</P> <PRE><CODE> | metadata type=sourcetypes index=* OR index=_* </CODE></PRE> <HR /> <P>Please do a search before asking a simple question like this, though. Here's the first few google results:</P> <P><A href="https://answers.splunk.com/answers/120461/how-to-see-all-source-and-sourcetype-list.html">https://answers.splunk.com/answers/120461/how-to-see-all-source-and-sourcetype-list.html</A><BR /> <A href="https://answers.splunk.com/answers/2521/fastest-way-to-show-all-sources-and-sourcetypes-in-an-index.html">https://answers.splunk.com/answers/2521/fastest-way-to-show-all-sources-and-sourcetypes-in-an-index.html</A><BR /> <A href="https://answers.splunk.com/answers/69704/how-can-i-list-all-indexes-and-sourcetypes.html">https://answers.splunk.com/answers/69704/how-can-i-list-all-indexes-and-sourcetypes.html</A><BR /> <A href="https://answers.splunk.com/answers/314680/how-do-i-list-all-sourcetypes-for-each-host-per-in.html">https://answers.splunk.com/answers/314680/how-do-i-list-all-sourcetypes-for-each-host-per-in.html</A></P> Thu, 09 Mar 2017 19:34:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-find-the-all-the-indexes-and-their/m-p/350014#M103625 DalJeanis 2017-03-09T19:34:26Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-find-the-all-the-indexes-and-their/m-p/350015#M103626 <P>If you are just trying to find all the sourcetypes you can also try <STRONG>metadata</STRONG> command</P> <PRE><CODE>| metadata type=sourcetypes index=* | table sourcetype </CODE></PRE> Thu, 09 Mar 2017 19:34:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-find-the-all-the-indexes-and-their/m-p/350015#M103626 niketn 2017-03-09T19:34:40Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-find-the-all-the-indexes-and-their/m-p/350016#M103627 <P>So your search might be cumbersome because you are not using metadata. Metadata is perfect for this instance and does not require Splunk to search all indexes at search time. </P> <P>You should use something like this...</P> <PRE><CODE> | metadata type=sourcetypes index=* </CODE></PRE> <P>Much like others above have mentioned.</P> Tue, 14 Mar 2017 13:23:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-find-the-all-the-indexes-and-their/m-p/350016#M103627 mgrosholz 2017-03-14T13:23:50Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-find-the-all-the-indexes-and-their/m-p/350017#M103628 <P>@kteng2024 - Looks like you have a few possible solutions to your question. If one of them provided a working solution, please don't forget to click "Accept" below the best answer to resolve this post. If you still need help, please leave a comment. Don’t forget to upvote anything that was helpful too. Thanks!</P> Fri, 07 Jul 2017 17:54:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-find-the-all-the-indexes-and-their/m-p/350017#M103628 aaraneta_splunk 2017-07-07T17:54:28Z