Splunk Search

How to check macro using sourcetype

sasankganta
Path Finder

I'm searching for list of indexes using

|tstats count where index=* sourcetype=log4j  by index sourcetype

I got results with lot of indexes in my environment. How can I find out which Data model / Macro using these indexes ?

Is there any way to find out where it's been using ? Thanks in advance.  

Labels (2)
Tags (1)
0 Karma

sasankganta
Path Finder

Hi @gcusello / Team,

I'm searching for list of indexes using

|tstats count where index=* sourcetype=log4j  by index sourcetype

I got results with lot of indexes in my environment. How can I find out which Data model / Macro using these indexes ?

Is there any way to find out where it's been using ? Thanks in advance. 

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.