Deployment Architecture

Listing all directories aka sources for unix server

bsaujla131984
Path Finder

How can we check which directories are being indexed for Unix server in Splunk?

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

| tstats values(source) AS sources WHERE (index=* OR index=_*) AND (sourcetype="ASourcetypeHere" OR ... OR sourcetype="AnotherSourcetypeHere") AND (host="AHostHere" OR ... OR host="AnotherHostHere") BY sourcetype

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

| tstats values(source) AS sources WHERE (index=* OR index=_*) AND (sourcetype="ASourcetypeHere" OR ... OR sourcetype="AnotherSourcetypeHere") AND (host="AHostHere" OR ... OR host="AnotherHostHere") BY sourcetype
0 Karma

to4kawa
Ultra Champion

Simply:

| metadata type=sources index=your_index

Check and try Apps

 Meta Woot!: https://splunkbase.splunk.com/app/2949/
 TrackMe: https://splunkbase.splunk.com/app/4621/,
 Broken Hosts App for Splunk: https://splunkbase.splunk.com/app/3247/
 Alerts for Splunk Admins ("ForwarderLevel" alerts): https://splunkbase.splunk.com/app/3796/
 Splunk Security Essentials(https://docs.splunksecurityessentials.com/features/sse_data_availability/): https://splunkbase.splunk.com/app/3435/
 Monitoring Console: https://docs.splunk.com/Documentation/Splunk/latest/DMC/Configureforwardermonitoring
 Deployment Server: https://docs.splunk.com/Documentation/DepMon/latest/DeployDepMon/Troubleshootyourdeployment#Forwarde...

thanks @woodcock

0 Karma

bsaujla131984
Path Finder

Actually I want to list sources of a server being indexed in Splunk...

0 Karma

to4kawa
Ultra Champion

Hi,@bsaujla131984
my answer is updated, please confirm.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>