How to see all source and sourcetype list

[rameshlpatel]

Hi,

In splunk UI, I am seeing only top 10 source and sourcetype list.

But I want to see all of them. Please suggest me on this.

[xlash911]

All answers querying for all sources from metadata had the same typo.

Use :

|metadata type=sources index=*

[sahilverma]

I am looking for sourcetype for parsing .csv files.

Source is Azure mscs:storage:blob

[vijayad]

Try to run below btool command and search for your sourcetype

opt/splunk/bin > ./splunk btool inputs list --debug > output.txt

[ujeshmaurya]

|metadata type=sourcetypes index="index_name"

|metadata type=source index="index_name"

This will work for sure. 🙂

[ujeshmaurya]

|metadata type=sourcetypes index="index_name"

|metadata type=source index="index_name"

This works nicely

[wrangler2x]

I like this search. If you have the OS app loaded on your instance (*nix) it has a bunch of its own sourcetypes that are not interesting, so that's why I exclude its index (os). If you don't, you can remove that last line of the search:

|rest /services/data/indexes count=0
| dedup title | fields title | map [|metadata type=sourcetypes index="$title$" | eval type="$title$"] maxsearches=1000
| stats values(type) AS index, values(totalCount) by sourcetype | sort sourcetype
| search NOT index=os

The output is a column of sourcetypes, with a second column of the index(es) that sourcetype is found in.

[bharathkumarnec]

Why don't you use license_usage.log file to get all the sources and sourcetypes??

index=_internal source=*license_usage.log

You will get all the data with s as source st as sourcetype, using this we can get the required information.

[saadhasankhan]

I am not an expert but I got indexes, sources and sourtypes as well as a custom "Customer" field with the following query:

source=* sourcetype=* [| eventcount summarize=false index=* | table index | format "(" "" "" "" "OR" ")"] |
 fillnull value="N/A" Customer 
| stats count by index, source, sourcetype, Customer 
| sort index, source, sourcetype, Customer

[axelabs]

I believe the metadata way display's all indexed source[type]'s ever. This may not be the lightest query, but gives me recent things:
" *** | chart count by sourcetype | sort count desc** " in the past hour

[somesoni2]

Use following (faster) for source

| metadata type=hosts index=* OR index=_*

for sourcetypes

| metadata type=sourcetypes index=* OR index=_*

[davidcottrell]

This does not work. You need to you source,field entries.

[adonio]

try this
| tstats values(source) where index = * by index

[joechakkola1]

thank you , this query was very helpful.

[rameshlpatel]

For this I have to run one extra queries for finding list of all source.

there is no any way to get list from existing fired query?

[tararso]

to view all sources : index=* |chart count by source
to view all sourcetypes: index=* |chart count by sourcetype

[mkinsley_splunk]

the reason this is inefficient is that you are asking the system to do a full scan of the index and aggregate the count. Your poor indexers have to process every single event . |metadata is what you want.

[CraigAtNuna]

Don't you need "index=*" and not "index="?