Report to break down indexes, source types and hosts.

[brent_weaver]

I am trying to write a live data dictionary in splunk so I don't have to maintain a list of indices and source types and how they map to hosts. Hopefully this makes sense. I would like the user to be able to look at a dashboard that lays out the index, source type and host.

Thanks!

[masonmorales · Accepted solution]

You could run this as a scheduled search:
| tstats values(host) as hosts where index=* groupby index,sourcetype | outputlookup splunk_data_catalog

Then create a report shared with all users that just has:
| inputlookup splunk_data_catalog

Make sure you create a splunk_data_catalog lookup definition that is also shared with all users.

[alemarzu]

@mason query seems to be okey but I believe it lacks the .csv at the end of the file name to work.

[masonmorales]

It will work after you create the lookup definition. You can run the first query without the outputlookup, then export the file and upload it back to Splunk by going to Settings, Lookup Files, and add it there. Then go to Settings, Lookup Definitions, create a new one, name it whatever you like, then point it at the CSV you just uploaded. Share the new lookup definition, then try the inputlookup using the name of the lookup definition you defined.

[alemarzu]

I'm aware of that, I just wanted to mentioned it before Brent came up with an error running that query. Thank you for taking the time to explain though.

[masonmorales]

It would not produce an error. You may be thinking of the inputcsv and outputcsv commands, which I believe do require a .csv extension since they call a .csv file directly instead of a lookup definition.

[adonio]

kindly use the | metadata command
https://docs.splunk.com/Documentation/Splunk/6.5.3/SearchReference/Metadata
here is another option using tstats for fast performance
| tstats values(sourcetype) where index=* by host

[masonmorales]

@brent_weaver just wanted to follow-up and see if you were able to get this working?

[masonmorales]

@brent_weaver just wanted to follow-up and see if you were able to get this working.