Getting Data In
Highlighted

Displaying which indexes/sourcetypes feed datamodels

Motivator

Hi,

is there an easy way to display which indexes (and/or) sourcetypes feed the data models that are configured? Or how do you onboard new data and make sure that you notice if the format of that data changes over time and no longer matches the criteria to be part of a data model?

Regards
Chris

Labels (2)
Tags (1)
Highlighted

Re: Displaying which indexes/sourcetypes feed datamodels

SplunkTrust
SplunkTrust

Hi Chris, A search such as this will give you an index/sourcetype breakdown of the events in a datamodel (Authentication for example)

| datamodel Authentication Authentication search | search * | stats count by sourcetype,index

If you have particular sourcetypes you care about, you could setup an alert on such a search for those sourcetypes missing.

Please let me know if this answers your question!

View solution in original post

Highlighted

Re: Displaying which indexes/sourcetypes feed datamodels

Motivator
0 Karma
Highlighted

Re: Displaying which indexes/sourcetypes feed datamodels

Motivator

That ist he search @jaime.ramirez proposes in his answer:
| datamodel
| rex field=_raw "\"modelName\"\s:\s\"(?[^\"]+)\""
| fields modelName
| table modelName
| map maxsearches=40 search="tstats summariesonly count from datamodel=$modelName$ by sourcetype,index | eval modelName=\"$modelName$\""

0 Karma