Splunk Search

How do you list Index, sourcetype and source using the REST command?

harshal_chakran
Builder

Hi,

I am working to list all the index with underlying sourcetypes and sources in it.

For which I am currently using the following command to run All Time

| tstats values(source) as source where index = * by index, sourcetype

The problem is that I have to run this search in the all time range, which is a heavy load and slow too.

Is there any |rest command to get results in much faster or any other command where I don't have to run search with an all time duration?

Thanks in advance.

0 Karma

lakshman239
Influencer

Did you try with summariesonly?

 | tstats `summariesonly` values(source) as source where index = * groupby index, sourcetype
0 Karma

harshal_chakran
Builder

Hi,
cannot find such macro ´summariesonly´.

Ran this search though
| tstats summariesonly=true values(source) as source where index = * groupby index, sourcetype

However, the problem is the same, that I have to run it all time to get all results.
Looking for more like a rest command, so can run for last 15 mins, etc.

0 Karma

lakshman239
Influencer
´summariesonly´ is in SA-Utils, but same as what you have now. tstats does support the search to run for last 15mins/60 mins, if that helps.

not sure if there is a direct rest api. One option would be to pull all indexes using rest and then use that on tstats, perhaps?

|rest /services/data/indexes | table title
0 Karma

harshal_chakran
Builder

Don't know why, but I have to select "all time" to get all index, sourcetype and source mapping using tstats command

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...