How do you list Index, sourcetype and source using the REST command?

[harshal_chakran]

Hi,

I am working to list all the index with underlying sourcetypes and sources in it.

For which I am currently using the following command to run All Time

| tstats values(source) as source where index = * by index, sourcetype

The problem is that I have to run this search in the all time range, which is a heavy load and slow too.

Is there any |rest command to get results in much faster or any other command where I don't have to run search with an all time duration?

Thanks in advance.

[mchoudhary]

Hi @lakshman239 ,

I am working on something similar. I have a dashboard which is simply showing all the indexes, its sourcetypes, source_counts and host_counts using tstats query-

| tstats values(sourcetype) as sourcetypes dc(host) as hosts_count dc(source) as sources_count where index = * by index

I am thinking to use rest query to populate the indexes in the dropdown and use then use that on tstats to show the sourcetypes/hosts for a particular index you pick in the dropdown.
Can you help here how you are suggesting using the output of rest api into tstats.

 | rest splunk_server=local /services/cluster_blaster_indexes/sh_indexes_manager/
| stats count by title 
| fields - count

 P.S. I am fairly new to splunk!

[Prewin27]

@mchoudhary 

You can try below sample xml dashboard code

<form>
<label>Index Sourcetype and Host/Source Explorer</label>

<fieldset submitButton="false" autoRun="true">
<input type="dropdown" token="selectedIndex" searchWhenChanged="true">
<label>Select Index:</label>
<choice value="*">All</choice>
<search>
<query>
| rest splunk_server=local /services/data/indexes
| search disabled=0
| stats count by title
| fields title
| rename title as index_name
</query>
<earliest>-1s</earliest>
<latest>now</latest>
</search>
<fieldForLabel>index_name</fieldForLabel>
<fieldForValue>index_name</fieldForValue>
<default>*</default>
</input>
</fieldset>

<row>
<panel>
<table>
<title>Details for Index: $selectedIndex$</title>
<search>
<query>
| tstats values(sourcetype) as sourcetypes,
dc(host) as host_count,
dc(source) as source_count
where index="$selectedIndex$" <!-- Use the token here -->
by index
| eval sourcetypes = mvjoin(sourcetypes, ", ")
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="count">20</option>
<option name="refresh">5m</option>
<option name="refresh.auto.interval">300</option>
</table>
</panel>
</row>
</form>

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a kudos/Karma. Thanks!

[mchoudhary]

@Prewin27 , yes that the correct way. I was able to figure it out yesterday 🙂

<form version="1.1" theme="dark">
  <label>Health Log Source Analysis</label>
  <fieldset submitButton="false"></fieldset>
  <row>
    <panel>
      <input type="multiselect" token="selected_index" searchWhenChanged="true">
        <label>Select Index(es)</label>
        <choice value="*">All</choice>
        <fieldForLabel>index</fieldForLabel>
        <fieldForValue>index</fieldForValue>
        <search>
          <query>| rest splunk_server=local /services/data/indexes
| fields title
| rename title as index
| sort index</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
      </input>
      <table>
        <title>Index and Sourcetypes</title>
        <search>
          <query>| tstats values(sourcetype) as sourcetypes dc(host) as hosts_count dc(source) as sources_count where index IN($selected_index$) by index</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

that's the query I used which worked.

[lakshman239]

Did you try with summariesonly?

 | tstats `summariesonly` values(source) as source where index = * groupby index, sourcetype

[harshal_chakran]

Hi,
cannot find such macro ´summariesonly´.

Ran this search though
| tstats summariesonly=true values(source) as source where index = * groupby index, sourcetype

However, the problem is the same, that I have to run it all time to get all results.
Looking for more like a rest command, so can run for last 15 mins, etc.

[lakshman239]

´summariesonly´ is in SA-Utils, but same as what you have now. tstats does support the search to run for last 15mins/60 mins, if that helps.

not sure if there is a direct rest api. One option would be to pull all indexes using rest and then use that on tstats, perhaps?

|rest /services/data/indexes | table title

[harshal_chakran]

Don't know why, but I have to select "all time" to get all index, sourcetype and source mapping using tstats command