Data/configuration report

[TeddyE]

I am looking to create a report to show just a subset of my Universal forwarders.  What I am looking for is an expansion on this that I just cannot seem to get working.  Any assistance appreciated!

| tstats values(sourcetype) AS Sourcetype dc(sourcetype) AS #sourcetypes WHERE index=* by host

for just the following indexes:  os, main, tomcat.

A great help would be to sort by deployment App (NIX, Unix, Linux) if possible, but I am not seeing anything in the system that shows the source of the data (which App is deployed).  

[TeddyE]

Thank you that is exactly it.  Appreciate the assist.  

[richgalloway]

To consider only certain indexes, include those index names in the query.

| tstats values(sourcetype) AS Sourcetype dc(sourcetype) AS #sourcetypes WHERE (index=os OR index=main OR index=tomcat) by host

The tstats command doesn't have app information available in most cases as events typically do not contain that field.  There are REST commands you can use to try to map sourcetype to app, but understand that there may be more than one app associated with a given sourcetype.