Splunk Search

Can you help me figure out why my query is not working?

VijaySrrie
Builder
index=* |stats count by sourcetype |table index sourcetype count

The above query displays the sourcetype and count details, but not the index details, Please help me figure out how to proceed.

Tags (1)
0 Karma
1 Solution

vnravikumar
Champion

Hi

try like

index=* |stats count by sourcetype, index

View solution in original post

0 Karma

amiracle
Splunk Employee
Splunk Employee

You might want to look at this free course as well: https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html

0 Karma

vnravikumar
Champion

Hi

try like

index=* |stats count by sourcetype, index
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Fixed.. Don't use index=* when searching over index time fields

| metasearch 
| stats count by sourcetype, index
0 Karma

VijaySrrie
Builder

|metasearch index=* | stats count by sourcetype, index

is working fine

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...