Is there a list that contains all the possible values for "eai:type" field in the REST endpoint: services/data/inputs/all

[anton085]

Hi,

When I go to :8089/services/data/inputs/all I get a list of all the inputs Splunk is listening to. In each input there is a field called eai:type. Is there a list that contains all the possible values eai:type can have? So far I have seen monitor and WinEventLog.

Thanks.

[woodcock · Accepted solution]

Those are not sourctypes but they are input types that are related to sourcetypes. Sourcetypes can be anything (almost). This is the closest thing that exists to a master list of sourcetypes:

http://docs.splunk.com/Documentation/Splunk/latest/Data/Listofpretrainedsourcetypes

The master list of inputs, more or less, can be found here: $SPLUNK_HOME/etc/system/README/inputs.conf.spec

But keep in mind, that adding apps can cause more inputs to be available (e.g. the ServiceNow stuff will add a "snow" input type).
So try this:

find $SPLUNK_HOME -name inputs.conf.spec

Read up on it all.

[nmclaughl1]

Regarding TA's that created Input types, like Splunk TA for AWS...
...and when installed to a SplunkCloud instance, I see a different count between the UI (10 - enabled) and | rest /services/data/inputs/all (7)

Is that a ticket to splunkCloud Ops or is there something you're aware of that "hides" some inputs from the rest api?

[jkat54]

Those look like sourcetypes. If so, it could be anything an admin defines.