Displaying which indexes/sourcetypes feed datamodels

[chris]

Hi,

is there an easy way to display which indexes (and/or) sourcetypes feed the data models that are configured? Or how do you onboard new data and make sure that you notice if the format of that data changes over time and no longer matches the criteria to be part of a data model?

Regards
Chris

[muebel · Accepted solution]

Hi Chris, A search such as this will give you an index/sourcetype breakdown of the events in a datamodel (Authentication for example)

| datamodel Authentication Authentication search | search * | stats count by sourcetype,index

If you have particular sourcetypes you care about, you could setup an alert on such a search for those sourcetypes missing.

Please let me know if this answers your question!

[chris]

That ist he search @jaime.ramirez proposes in his answer:
| datamodel
| rex field=_raw "\"modelName\"\s*:\s*\"(?[^\"]+)\""
| fields modelName
| table modelName
| map maxsearches=40 search="tstats summariesonly count from datamodel=$modelName$ by sourcetype,index | eval modelName=\"$modelName$\""

[chris]

This answer is also helpful https://answers.splunk.com/answers/597619/list-all-datamodels-with-the-feeds-index-sourcetyp.html