How do I count the number of sourcetypes being collected for specific indexes and hosts?

[a212830]

Hi,

I need to run a report for specific indexes and hosts that show the number of sourcetypes being collected for a specific time frame. How would I do that?

[somesoni2]

If you're on Splunk 6.1 OR above, we have very fast, sorry, lightening fast method to get this information using "tstats" command.

Sample usage

| tstats count WHERE index=* by index, host, sourcetype

For count of sourcetypes

 | tstats dc(sourcetype) as sourcetypes WHERE index=* by index, host

[richgalloway]

That counts the number of events by sourcetype. I believe the OP was looking for a count of sourcetypes.

[somesoni2]

Oops, updated the search to meet that requirement.

[maciep]

You might want to use tstats for that....something like

| tstats count where index=blah (host=somehost OR host=someotherhost OR host=something*) by sourcetype

[richgalloway]

There are probably a few ways to do that, depending on your data and how many indexes and hosts you want in the report. For example,

index=* | stats dc(sourcetype) as SourceTypes by index,host | table index host SourceTypes

will report the number of sourcetypes for all indexes and hosts. You can limit the results by adding to the base search

(index=foo OR index=bar) (host=system1 OR host=system2) | ...

[treinke]

Are you going to define the indexes and host? Are you saying show me the sourcetypes for index=A OR index=B and host=AA Or host=BB? Or are you looking for in the last 60 minutes show me all of the indexes getting data by any host and then also show me the sourcetypes that were logged?

[a212830]

yes, index=euc* host=lync*