topic Re: How to get the sourcetype in an index and its types like int, string or char etc by api in Splunk Search

How to get the sourcetype in an index and its types like int, string or char etc by api?

kitkit321 — Mon, 10 Jul 2023 12:51:20 GMT

Hi all,

I am new to API.
I want to use api to get all the sourcetype and its type in the index.
what should I do ?

Many Thanks.

Re: How to get the sourcetype in an index and its types like int, string or char etc by api

Gr0und_Z3r0 — Sun, 09 Jul 2023 13:03:07 GMT

hi @kitkit321
Use the metadata command to get the details.

|metadata type=sourcetypes index=my_index

Re: How to get the sourcetype in an index and its types like int, string or char etc by api

kitkit321 — Mon, 10 Jul 2023 06:28:41 GMT

How can i use the api to do it?

Re: How to get the sourcetype in an index and its types like int, string or char etc by api

GaetanVP — Mon, 10 Jul 2023 07:27:58 GMT

Hello @kitkit321,

You could try something like this (if you are connected on your Search Head, otherwise you'll need to replace https://localhost with the url of the Search Head you want to target).

curl -k -u admin:"<your_password>" https://localhost:8089/services/search/jobs -d search="| metadata type=sourcetypes index=<your_index> | table sourcetype" curl -k -u admin:"<your_password>" https://localhost:8089/services/services/search/jobs/<sid_returned_on_previous_command>/results

Hope it helps !

GaetanVP