How can we check which directories are being indexed for Unix server in Splunk?
Like this:
| tstats values(source) AS sources WHERE (index=* OR index=_*) AND (sourcetype="ASourcetypeHere" OR ... OR sourcetype="AnotherSourcetypeHere") AND (host="AHostHere" OR ... OR host="AnotherHostHere") BY sourcetype
Like this:
| tstats values(source) AS sources WHERE (index=* OR index=_*) AND (sourcetype="ASourcetypeHere" OR ... OR sourcetype="AnotherSourcetypeHere") AND (host="AHostHere" OR ... OR host="AnotherHostHere") BY sourcetype
Simply:
| metadata type=sources index=your_index
Check and try Apps
Meta Woot!: https://splunkbase.splunk.com/app/2949/
TrackMe: https://splunkbase.splunk.com/app/4621/,
Broken Hosts App for Splunk: https://splunkbase.splunk.com/app/3247/
Alerts for Splunk Admins ("ForwarderLevel" alerts): https://splunkbase.splunk.com/app/3796/
Splunk Security Essentials(https://docs.splunksecurityessentials.com/features/sse_data_availability/): https://splunkbase.splunk.com/app/3435/
Monitoring Console: https://docs.splunk.com/Documentation/Splunk/latest/DMC/Configureforwardermonitoring
Deployment Server: https://docs.splunk.com/Documentation/DepMon/latest/DeployDepMon/Troubleshootyourdeployment#Forwarde...
thanks @woodcock
Actually I want to list sources of a server being indexed in Splunk...
Hi,@bsaujla131984
my answer is updated, please confirm.