Splunk Search

How to create a lookup table for sourcetypes that are indexed into Splunk?

Path Finder

Hi all

i have various number of sourcetypes. i want to create lookup table for all my sourcetypes. i want all my sourcetypes that are indexed and will be indexed into Splunk in a single lookup table.

can any one please let me know how can i do this??


0 Karma

Ultra Champion

Splunk itself issues the following - | metadata type=sourcetypes | search totalCount > 0. You can output it into the lookup...

Just for reference, as we spoke about the automatic invocation of this call at How to avoid the automatic invocation of a metadata search upon a user's launch of a dashboard?

0 Karma


create a saved search with the below search query. and schedule it for required threshold like 1 hr / 1 day. rename the outputlookup name as per your requirement. (First run it for all time, then schedule it based on your above threshold).

Search :

|tstats  c where index=* sourcetype=* by index, sourcetype | fields - c | outputlookup index_sourcetype_lookup.csv

Run the search and confirm you want index / not? I have added sourcetype and index. if you dont like index remove it from group by.

Hope this will helps you!!!

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...