https://community.splunk.com/t5/Splunk-Search/How-to-list-all-sourcetypes/m-p/494251#M137793 <P>I am trying to list all sourcetypes in an index using dc<BR /> Using <CODE>index="test" | stats dc(sourcetype) as sourcetypes</CODE>only shows the total number of sourcetypes but does not list them individually.</P> Wed, 09 Oct 2019 09:52:31 GMT ialahdal 2019-10-09T09:52:31Z https://community.splunk.com/t5/Splunk-Search/How-to-list-all-sourcetypes/m-p/494251#M137793 <P>I am trying to list all sourcetypes in an index using dc<BR /> Using <CODE>index="test" | stats dc(sourcetype) as sourcetypes</CODE>only shows the total number of sourcetypes but does not list them individually.</P> Wed, 09 Oct 2019 09:52:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-list-all-sourcetypes/m-p/494251#M137793 ialahdal 2019-10-09T09:52:31Z https://community.splunk.com/t5/Splunk-Search/How-to-list-all-sourcetypes/m-p/494252#M137794 <P>To list them individually you must tell Splunk to do so. </P> <PRE><CODE>index="test" | stats count by sourcetype </CODE></PRE> <P>Alternative commands are</P> <PRE><CODE>| metadata type=sourcetypes index=test </CODE></PRE> <P>or</P> <PRE><CODE>| tstats count where index=test by sourcetype </CODE></PRE> Wed, 09 Oct 2019 11:45:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-list-all-sourcetypes/m-p/494252#M137794 richgalloway 2019-10-09T11:45:27Z https://community.splunk.com/t5/Splunk-Search/How-to-list-all-sourcetypes/m-p/494253#M137795 <P>What I was looking for is closer to <CODE>index="test" | stats dc(sourcetype) by sourcetype</CODE></P> <P>but thanks I was able to find this because of your answer.</P> Mon, 14 Oct 2019 05:24:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-list-all-sourcetypes/m-p/494253#M137795 ialahdal 2019-10-14T05:24:51Z