Is there a quick way on getting a list of all events coming in and all feeds coming in?
Would it also be possible to see which feeds are being used for the data models?
And also getting a list of feeds that are not being used in searches?
There are apps for this kind of thing on splunkbase. You can start with this:
index=* | stats values(tag) BY sourcetype
The tags will indicate which datamodels each sourcetype goes into.
View solution in original post