How can I search for the sourcetype and their key value pair setup (Name/Value) for all indexes?

[NanSplk01]

I want to create a list per index of all the sourcetypes under it and the key value pairs set in the sourcetypes and I want to export this to a cvs file.

index=*

Name                                                                    Value

CHARSET                                                            UTF-8

MAX_TIMESTAMP_LOOKAHEAD              23

etc:

[PickleRick]

And what's the use case? Because depending on your architecture you might not get what you want. Remember that there are search-time settings and index-time settings. And some index-time settings might even be configured in a place you don't have access to (if you have a HF in some external site, for example). Also remember that props can be defined on a per-source or per-host basis, not necessarily only per-sourcetype. So the overall picture might be much more complicated.

[somesoni2]

If you just want all the attributes setup for all sourcetypes, give this a try

| rest /services/configs/conf-props | table title * | regex title="^[A-z0-9]" | untable title attribute value | rename title as sourcetype

If you want index name as well, try this less efficient option

| rest /services/configs/conf-props | table title * | regex title="^[A-z0-9]" | untable title attribute value | rename title as sourcetype | join type=left sourcetype [ |tstats count WHERE index=* by index sourcetype | table index sourcetype  ]

[NanSplk01]

The 1st suggestion works, but as you indicated there were no indexes.  I ran the 2nd and only received one or two indexes, the others were blank.  I will keep working on the first search and see what I might come up with.  Thank you for the start.

[somesoni2]

In the 2nd search, the "tstats" command runs based of the selected time range, so if you want to see info for more index/sourcetypes, select a timerange for which that index/sourcetype will have data.