topic Re: How do I count the number of sourcetypes being collected for specific indexes and hosts? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-do-I-count-the-number-of-sourcetypes-being-collected-for/m-p/169476#M48437 <P>If you're on Splunk 6.1 OR above, we have very fast, sorry, lightening fast method to get this information using "tstats" command.</P> <P>Sample usage</P> <PRE><CODE>| tstats count WHERE index=* by index, host, sourcetype </CODE></PRE> <P>For count of sourcetypes</P> <PRE><CODE> | tstats dc(sourcetype) as sourcetypes WHERE index=* by index, host </CODE></PRE> Wed, 12 Aug 2015 15:01:46 GMT somesoni2 2015-08-12T15:01:46Z How do I count the number of sourcetypes being collected for specific indexes and hosts? https://community.splunk.com/t5/Splunk-Search/How-do-I-count-the-number-of-sourcetypes-being-collected-for/m-p/169472#M48433 <P>Hi,</P> <P>I need to run a report for specific indexes and hosts that show the number of sourcetypes being collected for a specific time frame. How would I do that? </P> Wed, 12 Aug 2015 14:26:55 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-count-the-number-of-sourcetypes-being-collected-for/m-p/169472#M48433 a212830 2015-08-12T14:26:55Z Re: How do I count the number of sourcetypes being collected for specific indexes and hosts? https://community.splunk.com/t5/Splunk-Search/How-do-I-count-the-number-of-sourcetypes-being-collected-for/m-p/169473#M48434 <P>Are you going to define the indexes and host? Are you saying show me the sourcetypes for index=A OR index=B and host=AA Or host=BB? Or are you looking for in the last 60 minutes show me all of the indexes getting data by any host and then also show me the sourcetypes that were logged?</P> Wed, 12 Aug 2015 14:34:49 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-count-the-number-of-sourcetypes-being-collected-for/m-p/169473#M48434 treinke 2015-08-12T14:34:49Z Re: How do I count the number of sourcetypes being collected for specific indexes and hosts? https://community.splunk.com/t5/Splunk-Search/How-do-I-count-the-number-of-sourcetypes-being-collected-for/m-p/169474#M48435 <P>There are probably a few ways to do that, depending on your data and how many indexes and hosts you want in the report. For example,</P> <PRE><CODE>index=* | stats dc(sourcetype) as SourceTypes by index,host | table index host SourceTypes </CODE></PRE> <P>will report the number of sourcetypes for all indexes and hosts. You can limit the results by adding to the base search</P> <PRE><CODE>(index=foo OR index=bar) (host=system1 OR host=system2) | ... </CODE></PRE> Wed, 12 Aug 2015 14:42:17 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-count-the-number-of-sourcetypes-being-collected-for/m-p/169474#M48435 richgalloway 2015-08-12T14:42:17Z Re: How do I count the number of sourcetypes being collected for specific indexes and hosts? https://community.splunk.com/t5/Splunk-Search/How-do-I-count-the-number-of-sourcetypes-being-collected-for/m-p/169475#M48436 <P>You might want to use tstats for that....something like</P> <P>| tstats count where index=blah (host=somehost OR host=someotherhost OR host=something*) by sourcetype</P> Wed, 12 Aug 2015 14:54:06 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-count-the-number-of-sourcetypes-being-collected-for/m-p/169475#M48436 maciep 2015-08-12T14:54:06Z Re: How do I count the number of sourcetypes being collected for specific indexes and hosts? https://community.splunk.com/t5/Splunk-Search/How-do-I-count-the-number-of-sourcetypes-being-collected-for/m-p/169476#M48437 <P>If you're on Splunk 6.1 OR above, we have very fast, sorry, lightening fast method to get this information using "tstats" command.</P> <P>Sample usage</P> <PRE><CODE>| tstats count WHERE index=* by index, host, sourcetype </CODE></PRE> <P>For count of sourcetypes</P> <PRE><CODE> | tstats dc(sourcetype) as sourcetypes WHERE index=* by index, host </CODE></PRE> Wed, 12 Aug 2015 15:01:46 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-count-the-number-of-sourcetypes-being-collected-for/m-p/169476#M48437 somesoni2 2015-08-12T15:01:46Z Re: How do I count the number of sourcetypes being collected for specific indexes and hosts? https://community.splunk.com/t5/Splunk-Search/How-do-I-count-the-number-of-sourcetypes-being-collected-for/m-p/169477#M48438 <P>That counts the number of events by sourcetype. I believe the OP was looking for a count of sourcetypes.</P> Wed, 12 Aug 2015 15:05:23 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-count-the-number-of-sourcetypes-being-collected-for/m-p/169477#M48438 richgalloway 2015-08-12T15:05:23Z Re: How do I count the number of sourcetypes being collected for specific indexes and hosts? https://community.splunk.com/t5/Splunk-Search/How-do-I-count-the-number-of-sourcetypes-being-collected-for/m-p/169478#M48439 <P>Oops, updated the search to meet that requirement.</P> Wed, 12 Aug 2015 15:11:47 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-count-the-number-of-sourcetypes-being-collected-for/m-p/169478#M48439 somesoni2 2015-08-12T15:11:47Z Re: How do I count the number of sourcetypes being collected for specific indexes and hosts? https://community.splunk.com/t5/Splunk-Search/How-do-I-count-the-number-of-sourcetypes-being-collected-for/m-p/169479#M48440 <P>yes, index=euc* host=lync* </P> Wed, 12 Aug 2015 15:31:18 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-count-the-number-of-sourcetypes-being-collected-for/m-p/169479#M48440 a212830 2015-08-12T15:31:18Z