how to list all hosts and sourcetypes of all indexes quickly

[bestSplunker]

I want to list all sourcetypes and hosts of indexes.

if i do :

|metadata type=hosts where index=*

can only list hosts.

if i do

|metadata type=sourcetypes where index=*

can only list sourcetypes

if i do:


index=* |stats values(host) by sourcetype

the search is very slowly

I want the result：

fistTime         Sourcetype        Host                    lastTime         recentTime        totalCount 

1522967692        nginx         192.168.1.2                 152340603        1523243447        29125

Each host and source type are corresponding

[niketn · Accepted solution]

@bestSplunker, you can use query like the following (depending on what access you have for indexes):

|  tstats count as totalCount earliest(_time) as firstTime latest(_time) as lastTime where index="_*" by host sourcetype
|  fieldformat firstTime=strftime(firstTime,"%Y/%m/%d %H:%M:%S")
|  fieldformat lastTime=strftime(lastTime,"%Y/%m/%d %H:%M:%S")

The above gets the stats for all internal Splunk indexes using index="_*".

[hunderliggur]

Add index at the end of line 1 and you will have a more complete picture if that is what you are looking for.

[gaurav_maniar]

Hi,

I have query related to tstats, can you please check below question,
https://answers.splunk.com/answers/770370/how-to-get-tstats-results-independent-of-time-rang.html

[bestSplunker]

Thank you for your reply, this is a best answer.