Getting Data In

How to see all source and sourcetype list

rameshlpatel
Communicator

Hi,

In splunk UI, I am seeing only top 10 source and sourcetype list.

But I want to see all of them. Please suggest me on this.

Tags (2)

xlash911
Explorer

All answers querying for all sources from metadata had the same typo.

 

Use :

|metadata type=sources index=*

0 Karma

sahilverma
Loves-to-Learn

I am looking for sourcetype for parsing .csv files.

Source is Azure mscs:storage:blob

0 Karma

vijayad
Explorer

Try to run below btool command and search for your sourcetype

opt/splunk/bin > ./splunk btool inputs list --debug > output.txt

0 Karma

ujeshmaurya
New Member

|metadata type=sourcetypes index="index_name"

|metadata type=source index="index_name"

This will work for sure. 🙂

0 Karma

ujeshmaurya
New Member

|metadata type=sourcetypes index="index_name"

|metadata type=source index="index_name"

This works nicely

0 Karma

wrangler2x
Motivator

I like this search. If you have the OS app loaded on your instance (*nix) it has a bunch of its own sourcetypes that are not interesting, so that's why I exclude its index (os). If you don't, you can remove that last line of the search:

|rest /services/data/indexes count=0
| dedup title | fields title | map [|metadata type=sourcetypes index="$title$" | eval type="$title$"] maxsearches=1000
| stats values(type) AS index, values(totalCount) by sourcetype | sort sourcetype
| search NOT index=os

The output is a column of sourcetypes, with a second column of the index(es) that sourcetype is found in.

0 Karma

bharathkumarnec
Communicator

Why don't you use license_usage.log file to get all the sources and sourcetypes??

index=_internal source=*license_usage.log

You will get all the data with s as source st as sourcetype, using this we can get the required information.

0 Karma

saadhasankhan
New Member

I am not an expert but I got indexes, sources and sourtypes as well as a custom "Customer" field with the following query:

source=* sourcetype=* [| eventcount summarize=false index=* | table index | format "(" "" "" "" "OR" ")"] |
 fillnull value="N/A" Customer 
| stats count by index, source, sourcetype, Customer 
| sort index, source, sourcetype, Customer
0 Karma

axelabs
Explorer

I believe the metadata way display's all indexed source[type]'s ever. This may not be the lightest query, but gives me recent things:
" *** | chart count by sourcetype | sort count desc** " in the past hour

0 Karma

somesoni2
Revered Legend

Use following (faster) for source

| metadata type=hosts index=* OR index=_*

for sourcetypes

| metadata type=sourcetypes index=* OR index=_*

davidcottrell
New Member

This does not work. You need to you source,field entries.

0 Karma

adonio
SplunkTrust
SplunkTrust

try this
| tstats values(source) where index = * by index

0 Karma

joechakkola1
Explorer

thank you , this query was very helpful.

0 Karma

rameshlpatel
Communicator

For this I have to run one extra queries for finding list of all source.

there is no any way to get list from existing fired query?

0 Karma

tararso
Explorer

to view all sources : index=* |chart count by source
to view all sourcetypes: index=* |chart count by sourcetype

mkinsley_splunk
Splunk Employee
Splunk Employee

the reason this is inefficient is that you are asking the system to do a full scan of the index and aggregate the count. Your poor indexers have to process every single event . |metadata is what you want.

CraigAtNuna
Explorer

Don't you need "index=*" and not "index="?

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!