Getting Data In
Highlighted

Can you help me in Identifying metadata?

Explorer

In the Splunk documentation for events, it lists this mock event

172.26.34.223 - - [01/Jul/2017:12:05:27 -0700] "GET /trade/app?action=logout HTTP/1.1" 200 2953

I need help identifying the host, source, and source type of this event. I can identify the host as 172.26.34.223, the timestamp as [01/Jul/2017:12:05:27 -0700 and I believe the source here is GET /trade/app?action=logout HTTP/1.1 but what is the source type?

0 Karma
Highlighted

Re: Can you help me in Identifying metadata?

SplunkTrust
SplunkTrust

Those metadata fields are defined at data input level (host/source/sourcetype/index etc). When you setup your data monitoring, that's when you'd specify them OR default values are taken. See this for more details:
https://docs.splunk.com/Documentation/Splunk/7.2.3/Data/Aboutdefaultfields

0 Karma
Highlighted

Re: Can you help me in Identifying metadata?

Influencer

Hi,

in your search app you can identify your sourcetype in the field section left of your event. Sourcetype should be a selected field by default, if not, you can find it further down in alphabetical order in Interesting Fields.

0 Karma
Highlighted

Re: Can you help me in Identifying metadata?

Contributor

Hi,
I believe that source you have indexed the data, if yes then you will find host, source and sourcetype in your all fields or you can also run the following search to find source or sourcetypes
| tstats values(source) where index = * by index OR | tstats values(sourcetype) where index = * by index

0 Karma