listdown the sourcetype from the index

[splunkpoornima]

Hi all

i used the below code..to list down the sourcetype of the main indx in the dropdown ..

sources

| metadata type=sourcetype index=main

please correct me if i made an mistake..

thanks in advance

[Ayn]

type=sourcetype is incorrect, it should be type=sourcetypes.

PLEASE PLEASE consult the docs as a first resort.

[splunkpoornima]

finnaly i got the output.now the problem is, i created two dropdowns one for sourcetypes so if i select source type i want the ist of sources in that sourcetype

| metadata type=sourcetypes index="main"



sources $tokenusedindropdown$

[Drainy]

That sounds like you have a space somewhere you shouldn't, could you edit your question with the updated xml?

[Ayn]

Doesn't sound like a problem in the dropdown.

[splunkpoornima]

actually i changed everything u said..after runing the code..i got got the error as

Error in 'search' command: Unable to parse the search: Comparator '=' is missing a term on the right hand side.

[Ayn]

Other errors include: it's populatingSearch, not populatingsearch. It's sourcetype, not SourceType.

[splunkpoornima]

no actually i used type=sourcetypes only but when typing here i missed