How to generate a search to find the all the indexes and their sourcetypes without using a wildcard?

[kteng2024]

hi,

i would like to know the search to find all the indexes and their sourcetypes . But my search is:

index=* | dedup sourcetype | table sourcetype 

and i selected " ALL TIME" . So, is there any other way to find out the indexes and their sourcetypes without using a wildcard and ALL TIME?

[aaraneta_splunk]

@kteng2024 - Looks like you have a few possible solutions to your question. If one of them provided a working solution, please don't forget to click "Accept" below the best answer to resolve this post. If you still need help, please leave a comment. Don’t forget to upvote anything that was helpful too. Thanks!

[mgrosholz]

So your search might be cumbersome because you are not using metadata. Metadata is perfect for this instance and does not require Splunk to search all indexes at search time.

You should use something like this...

 | metadata type=sourcetypes index=*

Much like others above have mentioned.

[niketn]

If you are just trying to find all the sourcetypes you can also try metadata command

| metadata type=sourcetypes index=* 
| table sourcetype

[DalJeanis]

Since you just want a list, no other info, you can just use the metadata.

 | metadata type=sourcetypes index=* OR index=_*

---

Please do a search before asking a simple question like this, though. Here's the first few google results:

https://answers.splunk.com/answers/120461/how-to-see-all-source-and-sourcetype-list.html
https://answers.splunk.com/answers/2521/fastest-way-to-show-all-sources-and-sourcetypes-in-an-index....
https://answers.splunk.com/answers/69704/how-can-i-list-all-indexes-and-sourcetypes.html
https://answers.splunk.com/answers/314680/how-do-i-list-all-sourcetypes-for-each-host-per-in.html

[s2_splunk]

Try this | tstats values(sourcetype) where index=* by index

It uses index files only, so it should complete pretty quickly without having to scan all of your data.