topic Re: sourcetypes in Splunk Search

sourcetypes

verifi81 — Tue, 10 Nov 2020 03:27:20 GMT

Is there a way to tell which method a sourcetype is using to get data into splunk?

For example, suppose I look at the sourcetype of an index named main

|metadata type=sourcetype index=main

It display a list of sourcetypes but I want to know if those sourtypes of syslog, from a heavy forwarder, or from a universal forwarder. Is that possible?

Re: sourcetypes

thambisetty — Tue, 10 Nov 2020 07:05:04 GMT

AFAIK, There is no direct way to identify this. you can identify using

index=_internal group=per_sourcetype_thruput sourcetype=splunkd host=<excludeyourindexers> | stats count by host,series | table host,series | rename series as sourcetype

Re: sourcetypes

isoutamo — Tue, 10 Nov 2020 07:22:27 GMT

That's good starting point. Unfortunately it shows only 10 most busiest sourcetypes by default.

https://docs.splunk.com/Documentation/Splunk/8.1.0/Troubleshooting/Aboutmetricslog
Unfortunately I couldn't recall any better way at this point.