topic Re: Searches in Splunk Search

Searches

whitecat001 — Tue, 28 May 2024 15:37:11 GMT

what command can i run if am not sure where an index for a data associated with a sourcetype is stored in splunk

gcusello — Tue, 28 May 2024 15:41:14 GMT

you could try:

index=* sourcetype=your_sourcetype

in this way you can know which is the index.

Ciao.

Giuseppe

deepakc — Tue, 28 May 2024 15:42:36 GMT

| tstats count where index=* by index, sourcetype

whitecat001 — Tue, 28 May 2024 15:43:30 GMT

thank you

antoniolamonica — Fri, 31 May 2024 17:11:59 GMT

you could try:

index=* | stats values(sourcetype) as sourcetype by index | table index, sourcetype

this will provide all sourcetypes associated to their index, based on the timeframe given and if they contain event logs during that time frame.

marysan — Fri, 31 May 2024 17:13:36 GMT

there are several queries :
for example sourcetype=Sample_sourcetype :
1-

| metadata type=sourcetypes | search sourcetype=Sample_sourcetype | table index, sourcetype

| tstats count where sourcetype=Sample_sourcetype by index | table index