https://community.splunk.com/t5/Splunk-Search/How-to-extract-all-hosts-and-their-sourcetypes/m-p/39763#M9108 <P>This is a slow way to list </P> <P>"* | top sourcetypes by host"</P> <HR /> <P>host, sourcetype, count, percent</P> <P>hostA, AAA, XXX, YY</P> <HR /> Fri, 23 Dec 2011 03:59:00 GMT rossikwan 2011-12-23T03:59:00Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-all-hosts-and-their-sourcetypes/m-p/39762#M9107 <P>Trying to right a search that will extract and display all the hosts that have indexed data and their sourcetypes. Anyone have any ideas?</P> Fri, 23 Dec 2011 00:55:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-all-hosts-and-their-sourcetypes/m-p/39762#M9107 sleathley 2011-12-23T00:55:09Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-all-hosts-and-their-sourcetypes/m-p/39763#M9108 <P>This is a slow way to list </P> <P>"* | top sourcetypes by host"</P> <HR /> <P>host, sourcetype, count, percent</P> <P>hostA, AAA, XXX, YY</P> <HR /> Fri, 23 Dec 2011 03:59:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-all-hosts-and-their-sourcetypes/m-p/39763#M9108 rossikwan 2011-12-23T03:59:00Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-all-hosts-and-their-sourcetypes/m-p/39764#M9109 <P>How you write the search depends on what you want. If you want to see how many events of each host/sourcetype combination, then you could use the following search</P> <PRE><CODE>host=* | fields host sourcetype | stats count by host sourcetype </CODE></PRE> <P>The fields command will make it run faster, but it will still be pretty slow because: if you want to see ALL the hosts, you will have to run this search over "All time".</P> <P>In the Summary view of the Search app, you can see a list of hosts, sourcetypes and sources. If you want a list like that, you can get it pretty quickly by using one of the following searches:</P> <PRE><CODE>| metadata type=hosts | metadata type=sourcetypes </CODE></PRE> <P>Yes, these searches are weird, they <STRONG>DO</STRONG> start with a pipe! You may want to use the table command to format the output. What these searches <STRONG>won't</STRONG> give you is "what are the sourcetypes that are associated with each host." But if you want a simple list, these searches will be much faster.</P> Fri, 23 Dec 2011 04:09:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-all-hosts-and-their-sourcetypes/m-p/39764#M9109 lguinn2 2011-12-23T04:09:56Z