Splunk Search

How to generate a search to find the all the indexes and their sourcetypes without using a wildcard?

kteng2024
Path Finder

hi,

i would like to know the search to find all the indexes and their sourcetypes . But my search is:

index=* | dedup sourcetype | table sourcetype 

and i selected " ALL TIME" . So, is there any other way to find out the indexes and their sourcetypes without using a wildcard and ALL TIME?

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@kteng2024 - Looks like you have a few possible solutions to your question. If one of them provided a working solution, please don't forget to click "Accept" below the best answer to resolve this post. If you still need help, please leave a comment. Don’t forget to upvote anything that was helpful too. Thanks!

0 Karma

mgrosholz
Path Finder

So your search might be cumbersome because you are not using metadata. Metadata is perfect for this instance and does not require Splunk to search all indexes at search time.

You should use something like this...

 | metadata type=sourcetypes index=*

Much like others above have mentioned.

0 Karma

niketn
Legend

If you are just trying to find all the sourcetypes you can also try metadata command

| metadata type=sourcetypes index=* 
| table sourcetype
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

s2_splunk
Splunk Employee
Splunk Employee

Try this | tstats values(sourcetype) where index=* by index

It uses index files only, so it should complete pretty quickly without having to scan all of your data.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...