Splunk Search

How do I display multiple sources, hosts, and source types on a table?

maryamchar
Explorer

I want a table that shows my hosts, sources, source types, and indexes with some data feeds. How do I approach that?

i was thinking to do

source=" source1" , host = " " sourcetype "sourcetype11 " , index= "index1" 
source="source2"  , host = " " sourcetype "sourcetype22 " , index= "index2" 

|table source, host, sourcetype, index 

The above is not working and not giving me results. Is there an easy way to solve this problem? I'm using Splunk Enterprise search and reporting. Thanks!

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try | tstats count by source, host, sourcetype, index | table source host sourcetype index.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try | tstats count by source, host, sourcetype, index | table source host sourcetype index.

---
If this reply helps you, Karma would be appreciated.
0 Karma

maryamchar
Explorer

Thank you so much!!!

0 Karma
Get Updates on the Splunk Community!

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

New Release | Splunk Cloud Platform 10.1.2507

Hello Splunk Community!We are thrilled to announce the General Availability of Splunk Cloud Platform 10.1.2507 ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...