How to list defined sourcetypes through API

[jbanker]

I am looking for a way to list all defined sourcetypes on a Splunk server, using the REST API.

From what little information I can find, it looks like it would be possible to crawl through the configuration files and look for defined sourcetypes, but I'm hoping there is an easier way.

[jbanker · Accepted solution]

So, I found my own answer. For anyone looking to solve this same problem in the future, I used:

https://splunkHost:8089/services/saved/sourcetypes?output_mode=json&count=1000

This gives a nice JSON parseable output of all the defined sourcetypes for a specific instance.

[traxxasbreaker]

From the search bar, try something like this as a starting point:

| rest /servicesNS/-/-/configs/conf-props

Note that if you are in a distributed environment, you might have to specify a splunk_server in your REST call to look at the part of the environment that your sourcetype is defined on (such as an indexer or heavy forwarder).

If you want to look at it from the CLI instead, you would do something like this:

curl -k -u : https://splunkHost:8089/services/configs/conf-props

[jbanker]

So, it looks like this can give me the sourcetypes that are currently in use by the configured inputs. Unfortunately as I stated, I'm looking to get a list of ALL configured sourcetypes available on a server. What I'm hoping to get is a list similar to what can be seen in the UI when you navigate to "Settings > Source types" or "https://splunkHost/en-US/manager/launcher/sourcetypes"