I am able to get a list of indexes and their source types using | metadata type=sources index=* sourcetype=* ||dedup source, but I want to add the source types to the list and be able to pick the index from a drop-down so that I get only the source types and sources for a particular index.
Got it going, it was just a matter of my time span.
@nls7010, if it works , please accept answer or let us know in case of further issues
Thank you for the guide below, but oddly even when I added the dropdown it's not affecting the search. This is one Panel in a dashboard, do I have to do something different to make it work there?
Hi @nls7010,
Try this ,
|tstats count by index,source,sourcetype|fields - count
if you have the index selected, then you could filter by
|tstats count where index=your_selected_index by source,sourcetype|fields - count
Do this tstats search in the UI like the other answer shows.
Try this search over a time window long enough to get all of the possible indexes, sources, and sourcetypes. Save it to a dashboard panel:
index=* | stats count by index sourcetype source
Add a dropdown input to your dashboard with this configuration:
Click on the magnifying glass at the top of your dashboard panel when in Edit mode to edit the search. Modify the search to use your token for the index value:
index=$myindex$ | stats count by index sourcetype source
Thank you all for your replies. I was able to get it to work as above.