Monitoring Splunk

How to know what kind of logs are indexing to each indexer

sravankaripe
Communicator

How to see what kind of logs are indexing to each indexer
can please help with splunk basic query.

Tags (1)
0 Karma
1 Solution

koshyk
Super Champion

To get all in one go

| tstats count where (index=_* OR index=*) by index, sourcetype, source

View solution in original post

0 Karma

koshyk
Super Champion

To get all in one go

| tstats count where (index=_* OR index=*) by index, sourcetype, source
0 Karma

sumanssah
Communicator

| tstats count where index=* by source (to get the list of source getting index)

| tstats count where index=* by source (to get the list of sourcetype getting index)

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...