Getting Data In

Data/configuration report


I am looking to create a report to show just a subset of my Universal forwarders.  What I am looking for is an expansion on this that I just cannot seem to get working.  Any assistance appreciated!

| tstats values(sourcetype) AS Sourcetype dc(sourcetype) AS #sourcetypes WHERE index=* by host

for just the following indexes:  os, main, tomcat.

A great help would be to sort by deployment App (NIX, Unix, Linux) if possible, but I am not seeing anything in the system that shows the source of the data (which App is deployed).  

Labels (4)
0 Karma


Thank you that is exactly it.  Appreciate the assist.  

0 Karma


To consider only certain indexes, include those index names in the query.

| tstats values(sourcetype) AS Sourcetype dc(sourcetype) AS #sourcetypes WHERE (index=os OR index=main OR index=tomcat) by host

The tstats command doesn't have app information available in most cases as events typically do not contain that field.  There are REST commands you can use to try to map sourcetype to app, but understand that there may be more than one app associated with a given sourcetype.

If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...