Getting Data In

How to create a report about each index and the sourcetypes it contains?

giy4
Engager

I need to create a report that shows each index on my system and the relevant data about sourcetypes within the index. I know I can use |metadata type=sourcetypes index=myindex and get the information for a specific index, but I want to basically pull all of my indexes and run that command for each of the indexes I have.

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Ok, so here you go. This uses the rest command, and the metadata command. It will increase in execution time as the number of indexes increases.

|rest /services/data/indexes count=0 | dedup title | fields title | map  [|metadata type=sourcetypes index="$title$" | eval type="$title$"] maxsearches=1000 | stats values(totalCount) by sourcetype type | rename type as index
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...