Getting Data In

How to see all source and sourcetype list

rameshlpatel
Communicator

Hi,

In splunk UI, I am seeing only top 10 source and sourcetype list.

But I want to see all of them. Please suggest me on this.

Tags (2)

xlash911
Explorer

All answers querying for all sources from metadata had the same typo.

 

Use :

|metadata type=sources index=*

0 Karma

sahilverma
Loves-to-Learn

I am looking for sourcetype for parsing .csv files.

Source is Azure mscs:storage:blob

0 Karma

vijayad
Explorer

Try to run below btool command and search for your sourcetype

opt/splunk/bin > ./splunk btool inputs list --debug > output.txt

0 Karma

ujeshmaurya
New Member

|metadata type=sourcetypes index="index_name"

|metadata type=source index="index_name"

This will work for sure. 🙂

0 Karma

ujeshmaurya
New Member

|metadata type=sourcetypes index="index_name"

|metadata type=source index="index_name"

This works nicely

0 Karma

wrangler2x
Motivator

I like this search. If you have the OS app loaded on your instance (*nix) it has a bunch of its own sourcetypes that are not interesting, so that's why I exclude its index (os). If you don't, you can remove that last line of the search:

|rest /services/data/indexes count=0
| dedup title | fields title | map [|metadata type=sourcetypes index="$title$" | eval type="$title$"] maxsearches=1000
| stats values(type) AS index, values(totalCount) by sourcetype | sort sourcetype
| search NOT index=os

The output is a column of sourcetypes, with a second column of the index(es) that sourcetype is found in.

0 Karma

bharathkumarnec
Communicator

Why don't you use license_usage.log file to get all the sources and sourcetypes??

index=_internal source=*license_usage.log

You will get all the data with s as source st as sourcetype, using this we can get the required information.

0 Karma

saadhasankhan
New Member

I am not an expert but I got indexes, sources and sourtypes as well as a custom "Customer" field with the following query:

source=* sourcetype=* [| eventcount summarize=false index=* | table index | format "(" "" "" "" "OR" ")"] |
 fillnull value="N/A" Customer 
| stats count by index, source, sourcetype, Customer 
| sort index, source, sourcetype, Customer
0 Karma

axelabs
Explorer

I believe the metadata way display's all indexed source[type]'s ever. This may not be the lightest query, but gives me recent things:
" *** | chart count by sourcetype | sort count desc** " in the past hour

0 Karma

somesoni2
Revered Legend

Use following (faster) for source

| metadata type=hosts index=* OR index=_*

for sourcetypes

| metadata type=sourcetypes index=* OR index=_*

davidcottrell
New Member

This does not work. You need to you source,field entries.

0 Karma

adonio
Ultra Champion

try this
| tstats values(source) where index = * by index

0 Karma

joechakkola1
Explorer

thank you , this query was very helpful.

0 Karma

rameshlpatel
Communicator

For this I have to run one extra queries for finding list of all source.

there is no any way to get list from existing fired query?

0 Karma

tararso
Explorer

to view all sources : index=* |chart count by source
to view all sourcetypes: index=* |chart count by sourcetype

mkinsley_splunk
Splunk Employee
Splunk Employee

the reason this is inefficient is that you are asking the system to do a full scan of the index and aggregate the count. Your poor indexers have to process every single event . |metadata is what you want.

CraigAtNuna
Explorer

Don't you need "index=*" and not "index="?

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...