Reporting

Report to break down indexes, source types and hosts.

Builder

I am trying to write a live data dictionary in splunk so I don't have to maintain a list of indices and source types and how they map to hosts. Hopefully this makes sense. I would like the user to be able to look at a dashboard that lays out the index, source type and host.

Thanks!

Tags (1)
0 Karma
1 Solution

Influencer

You could run this as a scheduled search:
| tstats values(host) as hosts where index=* groupby index,sourcetype | outputlookup splunk_data_catalog

Then create a report shared with all users that just has:
| inputlookup splunk_data_catalog

Make sure you create a splunkdatacatalog lookup definition that is also shared with all users.

View solution in original post

Influencer

You could run this as a scheduled search:
| tstats values(host) as hosts where index=* groupby index,sourcetype | outputlookup splunk_data_catalog

Then create a report shared with all users that just has:
| inputlookup splunk_data_catalog

Make sure you create a splunkdatacatalog lookup definition that is also shared with all users.

View solution in original post

Motivator

@mason query seems to be okey but I believe it lacks the .csv at the end of the file name to work.

0 Karma

Influencer

It will work after you create the lookup definition. You can run the first query without the outputlookup, then export the file and upload it back to Splunk by going to Settings, Lookup Files, and add it there. Then go to Settings, Lookup Definitions, create a new one, name it whatever you like, then point it at the CSV you just uploaded. Share the new lookup definition, then try the inputlookup using the name of the lookup definition you defined.

0 Karma

Motivator

I'm aware of that, I just wanted to mentioned it before Brent came up with an error running that query. Thank you for taking the time to explain though.

0 Karma

Influencer

It would not produce an error. You may be thinking of the inputcsv and outputcsv commands, which I believe do require a .csv extension since they call a .csv file directly instead of a lookup definition.

0 Karma

SplunkTrust
SplunkTrust

kindly use the | metadata command
https://docs.splunk.com/Documentation/Splunk/6.5.3/SearchReference/Metadata
here is another option using tstats for fast performance
| tstats values(sourcetype) where index=* by host

0 Karma

Influencer

@brent_weaver just wanted to follow-up and see if you were able to get this working?

0 Karma

Influencer

@brent_weaver just wanted to follow-up and see if you were able to get this working.

0 Karma