Splunk Search

How do you list Index, sourcetype and source using the REST command?

harshal_chakran
Builder

Hi,

I am working to list all the index with underlying sourcetypes and sources in it.

For which I am currently using the following command to run All Time

| tstats values(source) as source where index = * by index, sourcetype

The problem is that I have to run this search in the all time range, which is a heavy load and slow too.

Is there any |rest command to get results in much faster or any other command where I don't have to run search with an all time duration?

Thanks in advance.

0 Karma

lakshman239
Influencer

Did you try with summariesonly?

 | tstats `summariesonly` values(source) as source where index = * groupby index, sourcetype
0 Karma

harshal_chakran
Builder

Hi,
cannot find such macro ´summariesonly´.

Ran this search though
| tstats summariesonly=true values(source) as source where index = * groupby index, sourcetype

However, the problem is the same, that I have to run it all time to get all results.
Looking for more like a rest command, so can run for last 15 mins, etc.

0 Karma

lakshman239
Influencer
´summariesonly´ is in SA-Utils, but same as what you have now. tstats does support the search to run for last 15mins/60 mins, if that helps.

not sure if there is a direct rest api. One option would be to pull all indexes using rest and then use that on tstats, perhaps?

|rest /services/data/indexes | table title
0 Karma

harshal_chakran
Builder

Don't know why, but I have to select "all time" to get all index, sourcetype and source mapping using tstats command

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...