Splunk Enterprise Security

Is there a page view that shows all Source's for an Index

Aside from doing a search is there a configuration page that will show me all the sources sending logs to an index at a quick glance?

0 Karma
1 Solution

Splunk Employee
Splunk Employee

The user that runs |metadata needs get_metadata capability, which the user role should have by default, but you may want to check that.

Make sure you select the correct time in the timepicker, and change the index name as appropriate

Also, the command listed above will return sourcetypes. If you want sources, you need
| metadata type=sources index=indexname

View solution in original post

Contributor
|tstats values(sourcetype) as sourcetypes, values(source) as sources where index=* by index
0 Karma

Splunk Employee
Splunk Employee

The user that runs |metadata needs get_metadata capability, which the user role should have by default, but you may want to check that.

Make sure you select the correct time in the timepicker, and change the index name as appropriate

Also, the command listed above will return sourcetypes. If you want sources, you need
| metadata type=sources index=indexname

View solution in original post

SplunkTrust
SplunkTrust

Not other than the data summary on the default search view.

Here's a good search for that though:

| metadata type=sourcetypes index=yourindex 
0 Karma

SplunkTrust
SplunkTrust

You can make your own dashboard using the above.

0 Karma

Hmmm thats not returning anything for me.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!