topic Re: How do you list Index, sourcetype and source using the REST command? in Splunk Search

How do you list Index, sourcetype and source using the REST command?

harshal_chakran — Wed, 06 Mar 2019 08:50:12 GMT

Hi,

I am working to list all the index with underlying sourcetypes and sources in it.

For which I am currently using the following command to run All Time

| tstats values(source) as source where index = * by index, sourcetype

The problem is that I have to run this search in the all time range, which is a heavy load and slow too.

Is there any |rest command to get results in much faster or any other command where I don't have to run search with an all time duration?

Thanks in advance.

Re: How do you list Index, sourcetype and source using the REST command?

lakshman239 — Wed, 06 Mar 2019 09:46:35 GMT

Did you try with summariesonly?

 | tstats `summariesonly` values(source) as source where index = * groupby index, sourcetype

Re: How do you list Index, sourcetype and source using the REST command?

harshal_chakran — Wed, 06 Mar 2019 10:51:41 GMT

Hi,
cannot find such macro ´summariesonly´.

Ran this search though
| tstats summariesonly=true values(source) as source where index = * groupby index, sourcetype

However, the problem is the same, that I have to run it all time to get all results.
Looking for more like a rest command, so can run for last 15 mins, etc.

Re: How do you list Index, sourcetype and source using the REST command?

lakshman239 — Wed, 06 Mar 2019 11:20:41 GMT

´summariesonly´ is in SA-Utils, but same as what you have now. tstats does support the search to run for last 15mins/60 mins, if that helps.

not sure if there is a direct rest api. One option would be to pull all indexes using rest and then use that on tstats, perhaps?

|rest /services/data/indexes | table title

Re: How do you list Index, sourcetype and source using the REST command?

harshal_chakran — Wed, 06 Mar 2019 17:17:37 GMT

Don't know why, but I have to select "all time" to get all index, sourcetype and source mapping using tstats command

Re: How do you list Index, sourcetype and source using the REST command?

mchoudhary — Thu, 29 May 2025 14:02:08 GMT

Hi @lakshman239 ,

I am working on something similar. I have a dashboard which is simply showing all the indexes, its sourcetypes, source_counts and host_counts using tstats query-

| tstats values(sourcetype) as sourcetypes dc(host) as hosts_count dc(source) as sources_count where index = * by index

I am thinking to use rest query to populate the indexes in the dropdown and use then use that on tstats to show the sourcetypes/hosts for a particular index you pick in the dropdown.
Can you help here how you are suggesting using the output of rest api into tstats.

 | rest splunk_server=local /services/cluster_blaster_indexes/sh_indexes_manager/
| stats count by title 
| fields - count

P.S. I am fairly new to splunk!

Re: How do you list Index, sourcetype and source using the REST command?

PrewinThomas — Fri, 30 May 2025 04:44:16 GMT

@mchoudhary

You can try below sample xml dashboard code

<form>
<label>Index Sourcetype and Host/Source Explorer</label>

<fieldset submitButton="false" autoRun="true">
<input type="dropdown" token="selectedIndex" searchWhenChanged="true">
<label>Select Index:</label>
<choice value="*">All</choice>
<search>
<query>
| rest splunk_server=local /services/data/indexes
| search disabled=0
| stats count by title
| fields title
| rename title as index_name
</query>
<earliest>-1s</earliest>
<latest>now</latest>
</search>
<fieldForLabel>index_name</fieldForLabel>
<fieldForValue>index_name</fieldForValue>
<default>*</default>
</input>
</fieldset>

<row>
<panel>
<table>
<title>Details for Index: $selectedIndex$</title>
<search>
<query>
| tstats values(sourcetype) as sourcetypes,
dc(host) as host_count,
dc(source) as source_count
where index="$selectedIndex$" 
by index
| eval sourcetypes = mvjoin(sourcetypes, ", ")
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="count">20</option>
<option name="refresh">5m</option>
<option name="refresh.auto.interval">300</option>
</table>
</panel>
</row>
</form>

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a kudos/Karma. Thanks!

Re: How do you list Index, sourcetype and source using the REST command?

mchoudhary — Fri, 30 May 2025 11:24:20 GMT

@PrewinThomas , yes that the correct way. I was able to figure it out yesterday 🙂

<form version="1.1" theme="dark"> <label>Health Log Source Analysis</label> <fieldset submitButton="false"></fieldset> <row> <panel> <input type="multiselect" token="selected_index" searchWhenChanged="true"> <label>Select Index(es)</label> <choice value="*">All</choice> <fieldForLabel>index</fieldForLabel> <fieldForValue>index</fieldForValue> <search> <query>| rest splunk_server=local /services/data/indexes | fields title | rename title as index | sort index</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> </input> <table> <title>Index and Sourcetypes</title> <search> <query>| tstats values(sourcetype) as sourcetypes dc(host) as hosts_count dc(source) as sources_count where index IN($selected_index$) by index</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form>

that's the query I used which worked.