Getting Data In

how to get the list of sources and sourcetypes grouped by index for a specific app?

vrmandadi
Builder

I am using the below query to get the list of all sourcetypes for a specific app

| rest /services/saved/sourcetypes | fields title, "eai:acl.app" | rename title AS sourcetype, "eai:acl.app" AS app_name | search app_name=vams | search sourcetype!=rest AND sourcetype!=a_test AND sourcetype!=my_test_data | dedup sourcetype

This gives me list of all sources

| metadata type=sources index=* |dedup source

but how can group it by indexes to get source and sourcetype for each index

0 Karma

somesoni2
Revered Legend

Try this

| tstats count WHERE [| rest /services/saved/sourcetypes | fields title, "eai:acl.app" | rename title AS sourcetype, "eai:acl.app" AS app_name | search app_name=vams | search sourcetype!=rest AND sourcetype!=a_test AND sourcetype!=my_test_data | dedup sourcetype | table sourcetype] by index sourcetype source
0 Karma
Get Updates on the Splunk Community!

Detecting Brute Force Account Takeover Fraud with Splunk

This article is the second in a three-part series exploring advanced fraud detection techniques using Splunk. ...

Buttercup Games: Further Dashboarding Techniques (Part 9)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games: Further Dashboarding Techniques (Part 8)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...