Getting Data In

Data/configuration report


I am looking to create a report to show just a subset of my Universal forwarders.  What I am looking for is an expansion on this that I just cannot seem to get working.  Any assistance appreciated!

| tstats values(sourcetype) AS Sourcetype dc(sourcetype) AS #sourcetypes WHERE index=* by host

for just the following indexes:  os, main, tomcat.

A great help would be to sort by deployment App (NIX, Unix, Linux) if possible, but I am not seeing anything in the system that shows the source of the data (which App is deployed).  

Labels (4)
0 Karma


Thank you that is exactly it.  Appreciate the assist.  

0 Karma


To consider only certain indexes, include those index names in the query.

| tstats values(sourcetype) AS Sourcetype dc(sourcetype) AS #sourcetypes WHERE (index=os OR index=main OR index=tomcat) by host

The tstats command doesn't have app information available in most cases as events typically do not contain that field.  There are REST commands you can use to try to map sourcetype to app, but understand that there may be more than one app associated with a given sourcetype.

If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...