Splunk Search

How to get the sourcetype in an index and its types like int, string or char etc by api?

kitkit321
Explorer

Hi all,

I am new to API.
I want to use api to get all the sourcetype and its type in the index.
what should I do ?

Many Thanks.

Tags (1)
0 Karma

GaetanVP
Contributor

Hello @kitkit321,

You could try something like this (if you are connected on your Search Head, otherwise you'll need to replace https://localhost with the url of the Search Head you want to target).

 

curl -k -u admin:"<your_password>" https://localhost:8089/services/search/jobs -d search="| metadata type=sourcetypes index=<your_index> | table sourcetype"

curl -k -u admin:"<your_password>" https://localhost:8089/services/services/search/jobs/<sid_returned_on_previous_command>/results

 

Hope it helps !

GaetanVP

Tags (3)
0 Karma

Gr0und_Z3r0
Contributor

hi @kitkit321 
Use the metadata command to get the details.

|metadata type=sourcetypes index=my_index

0 Karma

kitkit321
Explorer

How can i use the api to do it?

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...