I would like to have a list of all the hosts (over some period of time, presumably) and the sources that they've generated logs entries with. A simple table format would work, so there'd be 10 lines for host X, each with a different source listed, if host X generated logs for 10 sources.
host1,source1 host1,source2 host2,source1 host2,source3 host2,source4
Is there a way I can get this information? I see how to pull hosts using metadata, and I see how to pull sources using metadata, but I don't see how the two can be related.
You can use the following search to accomplish this (slightly different output than you've specified):
* | chart values(source) by host
Or, if you want to include the all (including internal) indexes:
index=* | chart values(source) by host
Very good, thank you - even though the output format wasn't what I was thinking of, it's still useful and it helps me think in terms of how chart can help me. Thanks!