Getting Data In

How to list defined sourcetypes through API

jbanker
Explorer

I am looking for a way to list all defined sourcetypes on a Splunk server, using the REST API.

From what little information I can find, it looks like it would be possible to crawl through the configuration files and look for defined sourcetypes, but I'm hoping there is an easier way.

0 Karma
1 Solution

jbanker
Explorer

So, I found my own answer. For anyone looking to solve this same problem in the future, I used:

https://splunkHost:8089/services/saved/sourcetypes?output_mode=json&count=1000

This gives a nice JSON parseable output of all the defined sourcetypes for a specific instance.

View solution in original post

jbanker
Explorer

So, I found my own answer. For anyone looking to solve this same problem in the future, I used:

https://splunkHost:8089/services/saved/sourcetypes?output_mode=json&count=1000

This gives a nice JSON parseable output of all the defined sourcetypes for a specific instance.

traxxasbreaker
Communicator

From the search bar, try something like this as a starting point:

| rest /servicesNS/-/-/configs/conf-props

Note that if you are in a distributed environment, you might have to specify a splunk_server in your REST call to look at the part of the environment that your sourcetype is defined on (such as an indexer or heavy forwarder).

If you want to look at it from the CLI instead, you would do something like this:

curl -k -u : https://splunkHost:8089/services/configs/conf-props

0 Karma

jbanker
Explorer

So, it looks like this can give me the sourcetypes that are currently in use by the configured inputs. Unfortunately as I stated, I'm looking to get a list of ALL configured sourcetypes available on a server. What I'm hoping to get is a list similar to what can be seen in the UI when you navigate to "Settings > Source types" or "https://splunkHost/en-US/manager/launcher/sourcetypes"

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...