Splunk Search

How to generate a search to find the all the indexes and their sourcetypes without using a wildcard?

kteng2024
Path Finder

hi,

i would like to know the search to find all the indexes and their sourcetypes . But my search is:

index=* | dedup sourcetype | table sourcetype 

and i selected " ALL TIME" . So, is there any other way to find out the indexes and their sourcetypes without using a wildcard and ALL TIME?

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@kteng2024 - Looks like you have a few possible solutions to your question. If one of them provided a working solution, please don't forget to click "Accept" below the best answer to resolve this post. If you still need help, please leave a comment. Don’t forget to upvote anything that was helpful too. Thanks!

0 Karma

mgrosholz
Path Finder

So your search might be cumbersome because you are not using metadata. Metadata is perfect for this instance and does not require Splunk to search all indexes at search time.

You should use something like this...

 | metadata type=sourcetypes index=*

Much like others above have mentioned.

0 Karma

niketnilay
Legend

If you are just trying to find all the sourcetypes you can also try metadata command

| metadata type=sourcetypes index=* 
| table sourcetype
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

s2_splunk
Splunk Employee
Splunk Employee

Try this | tstats values(sourcetype) where index=* by index

It uses index files only, so it should complete pretty quickly without having to scan all of your data.

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!