Getting Data In

How do I list all sources on a specific host?

New Member

Hi all, How do I show all sources for a specific host? I can query for a specific host a la: host="myhost" and then hit "source" in the sidebar, but that only shows the top ten sources on that host. I don't know how to see more than that. I have seen an example of how to list all sources for all hosts by host, but that's extremely long running in our environment and not really what we need. I just need to see the sources for specific hosts to verify that our indexing config is setup correctly and the logs that we want to be indexed are showing up as sources. I'm guessing this is any easy one, but I am splunk noob and haven't been able to figure it out. Any help is appreciated. Thanks!


Tags (1)
0 Karma

host="hostname" | stats count by source
0 Karma


This should be the fastest method per my knowledge

|metasearch host="<yourhostname>"

This search will provide following fields:-


From which you can use source field for your requirement.

Super Champion

The full search would look like this:
|metasearch host="" | dedup source | table source

0 Karma

Path Finder

host="abc" | dedup source | table field source

Get Updates on the Splunk Community!

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...

Customer Experience | Call for Stories: Your 2023 Journey with Splunk!

Share your Splunk journey: Splunk is committed to supporting our customers toward success. As the year draws ...

Infographic provides the TL;DR for the 2023 Splunk Career Impact Report

We’ve been shouting it from the rooftops! The findings from the 2023 Splunk Career Impact Report showing that ...