topic useing metadata commend to display sourcetype host and sources at the same time in Splunk Search

useing metadata commend to display sourcetype host and sources at the same time

samlinsongguo — Tue, 27 Mar 2018 19:42:54 GMT

HI
I want to use | metadata commend to display sourcetype host and sources at the same time, so far I cant make connection between them.
As we know when I run | metadata type=sourcetypes search it will return me sourcetype information,like below

firstTime   lastTime   recentTime sourcetype totalCount type
151572    1515399    152170     RT2RO   108      sourcetypes

the output I am looking for is

firstTime   lastTime   recentTime sourcetype totalCount source       host
  151572    1515399    152170       RT2RO   108     \var\log\a   rt2.server.com

Can this be done using | metadata command?
The reason I want to use it is just because it give result fast 🙂
Thanks in advance

Re: useing metadata commend to display sourcetype host and sources at the same time

adonio — Tue, 27 Mar 2018 19:53:04 GMT

hello there,
not sure how to achieve with | metadata (without | append or | appendcols ) but give ashot to the next search:
|tstats count as event_count min(_time) as firstTime max(_time) as lastTime by host source sourcetype where index=*

hope it helps

Re: useing metadata commend to display sourcetype host and sources at the same time

samlinsongguo — Wed, 28 Mar 2018 08:50:28 GMT

Thanks Adonio, not very familiar with tstats but it got what I want thanks again.