Knowledge Management

list all datamodels with the feeds (index, sourcetype)

ecanmaster
Explorer

Is there an easy way of showing list of all used datamodels and with which are coming in (index, sourcetype)?
So far I can do a search on each datamodel and get the indexes, but this means I have to do this separately on every datamodel.

Tags (1)

edoardo_vicendo
Contributor

Starting from @jaime_ramirez  solution I have added a portion of SPL to check whether or not your sourcetypes are going into which datamodels:

| datamodel
| rex field=_raw "\"modelName\"\s*\:\s*\"(?<modelName>[^\"]+)\""
| search NOT modelName IN (Splunk_CIM_Validation)
| fields modelName
| table modelName
| map maxsearches=40 search="tstats summariesonly=true count from datamodel=$modelName$ by sourcetype | eval modelName=\"$modelName$\""
| append [| search index=_internal source=*license_usage.log type="Usage" pool="herePutYourLicensePool"
  | eval sourcetype = st
  | stats count by sourcetype
  | eval modelName="removeit", count=0
  | fields sourcetype modelName count]
| xyseries sourcetype modelName count | fillnull value="N"
| fields - removeit

 

0 Karma

jaime_ramirez
Communicator

I found this way to be somewhat effective

| datamodel 
| rex field=_raw "\"modelName\"\s*\:\s*\"(?<modelName>[^\"]+)\"" 
| fields modelName 
| table modelName 
| map maxsearches=40 search="tstats `summariesonly` count from datamodel=$modelName$ by sourcetype,index | eval modelName=\"$modelName$\""
Tags (1)

TheDairyGuy
Engager

Excellent!  I love it when someone provides working SPL that I can just copy and paste - and BOOM it gives me what I need.  Thank you!

Tags (2)
0 Karma

makeresults
Engager

Outstanding, Jaime. Thanks for sharing. Without any modification to your search, I was able to copy/paste and find the answer.

0 Karma

chris
Motivator

Worked for me thanks.

0 Karma

ecanmaster
Explorer

here is a way on how to do it, but you need to add all the datamodels manually:

| tstats `summariesonly` count from datamodel=datamodel1 by sourcetype,index 
| eval DM="Datamodel1" 
| append 
    [| tstats `summariesonly` count from datamodel=datamodel2 by sourcetype,index 
    | eval DM="datamodel2"] 
| append 
    [| tstats `summariesonly` count from datamodel=datamodel3 by sourcetype,index 
    | eval DM="datamodel3"] 
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>