Splunk Search

How to extract all hosts and their sourcetypes?

sleathley
Explorer

Trying to right a search that will extract and display all the hosts that have indexed data and their sourcetypes. Anyone have any ideas?

Tags (1)

lguinn2
Legend

How you write the search depends on what you want. If you want to see how many events of each host/sourcetype combination, then you could use the following search

host=* | fields host sourcetype | stats count by host sourcetype

The fields command will make it run faster, but it will still be pretty slow because: if you want to see ALL the hosts, you will have to run this search over "All time".

In the Summary view of the Search app, you can see a list of hosts, sourcetypes and sources. If you want a list like that, you can get it pretty quickly by using one of the following searches:

| metadata type=hosts

| metadata type=sourcetypes

Yes, these searches are weird, they DO start with a pipe! You may want to use the table command to format the output. What these searches won't give you is "what are the sourcetypes that are associated with each host." But if you want a simple list, these searches will be much faster.

rossikwan
Path Finder

This is a slow way to list

"* | top sourcetypes by host"


host, sourcetype, count, percent

hostA, AAA, XXX, YY


0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...