I need help to find a query that can list every source types and indexes of each and every app present in the search head or an instance. Is it possible to get the results using SPL?
Hi, I'm also new, I don't know if what I'm going to answer is helpful, I'll still try
index=* |stats count by index sourcetype app |sort -count
What I am trying to achieve is get list of all sourcetypes and indexes of TA. By that I mean what sourcetype and indexes is that specific TA is using.