Splunk Search

How to get the sourcetype in an index and its types like int, string or char etc by api?

kitkit321
Explorer

Hi all,

I am new to API.
I want to use api to get all the sourcetype and its type in the index.
what should I do ?

Many Thanks.

Tags (1)
0 Karma

GaetanVP
Contributor

Hello @kitkit321,

You could try something like this (if you are connected on your Search Head, otherwise you'll need to replace https://localhost with the url of the Search Head you want to target).

 

curl -k -u admin:"<your_password>" https://localhost:8089/services/search/jobs -d search="| metadata type=sourcetypes index=<your_index> | table sourcetype"

curl -k -u admin:"<your_password>" https://localhost:8089/services/services/search/jobs/<sid_returned_on_previous_command>/results

 

Hope it helps !

GaetanVP

Tags (3)
0 Karma

Gr0und_Z3r0
Contributor

hi @kitkit321 
Use the metadata command to get the details.

|metadata type=sourcetypes index=my_index

0 Karma

kitkit321
Explorer

How can i use the api to do it?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...