Hi,
I need to run a report for specific indexes and hosts that show the number of sourcetypes being collected for a specific time frame. How would I do that?
If you're on Splunk 6.1 OR above, we have very fast, sorry, lightening fast method to get this information using "tstats" command.
Sample usage
| tstats count WHERE index=* by index, host, sourcetype
For count of sourcetypes
| tstats dc(sourcetype) as sourcetypes WHERE index=* by index, host
That counts the number of events by sourcetype. I believe the OP was looking for a count of sourcetypes.
Oops, updated the search to meet that requirement.
You might want to use tstats for that....something like
| tstats count where index=blah (host=somehost OR host=someotherhost OR host=something*) by sourcetype
There are probably a few ways to do that, depending on your data and how many indexes and hosts you want in the report. For example,
index=* | stats dc(sourcetype) as SourceTypes by index,host | table index host SourceTypes
will report the number of sourcetypes for all indexes and hosts. You can limit the results by adding to the base search
(index=foo OR index=bar) (host=system1 OR host=system2) | ...
Are you going to define the indexes and host? Are you saying show me the sourcetypes for index=A OR index=B and host=AA Or host=BB? Or are you looking for in the last 60 minutes show me all of the indexes getting data by any host and then also show me the sourcetypes that were logged?
yes, index=euc* host=lync*