Splunk Search

How to get the sourcetype in an index and its types like int, string or char etc by api?

kitkit321
Explorer

Hi all,

I am new to API.
I want to use api to get all the sourcetype and its type in the index.
what should I do ?

Many Thanks.

Tags (1)
0 Karma

GaetanVP
Contributor

Hello @kitkit321,

You could try something like this (if you are connected on your Search Head, otherwise you'll need to replace https://localhost with the url of the Search Head you want to target).

 

curl -k -u admin:"<your_password>" https://localhost:8089/services/search/jobs -d search="| metadata type=sourcetypes index=<your_index> | table sourcetype"

curl -k -u admin:"<your_password>" https://localhost:8089/services/services/search/jobs/<sid_returned_on_previous_command>/results

 

Hope it helps !

GaetanVP

Tags (3)
0 Karma

Gr0und_Z3r0
Contributor

hi @kitkit321 
Use the metadata command to get the details.

|metadata type=sourcetypes index=my_index

0 Karma

kitkit321
Explorer

How can i use the api to do it?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...