How to monitor inactive sourcetypes(or inactive indexes) in Splunk?

[512anagha]

I need to create alert for inactive sourcetypes or index. All the logs are coming from a single host( a syslog server), so cannot create an alert based on host.

For using metadata command "type" is required but I am unable to set type as index or sourcetype
| metadata type=hosts | sort recentTime | convert ctime(recentTime) as Latest_Time

The following usecase helps me to get all the indexes and source types, but I am unable to set the time to check for the inactive requirement.
| tstats values(sourcetype) where index=* group by index

[dineshraj9 · Accepted solution]

You have to use type=sourcetypes with metadata.

For sourcetypes that didn't report data in last 7 days -

| metadata type=sourcetypes | eval diff=now()-lastTime | where diff > 3600*24*7 | convert ctime(lastTime) | convert ctime(firstTime)  | convert ctime(recentTime) | sort -diff

[gjanders]

Alternatively have a look at metawoot this provides an enhanced metadata list in the form of a lookup file with more detail than the default metadata command...