Splunk Search
Highlighted

How to list all sourcetypes

Path Finder

I am trying to list all sourcetypes in an index using dc
Using index="test" | stats dc(sourcetype) as sourcetypesonly shows the total number of sourcetypes but does not list them individually.

Tags (2)
0 Karma
Highlighted

Re: How to list all sourcetypes

SplunkTrust
SplunkTrust

To list them individually you must tell Splunk to do so.

index="test" | stats count by sourcetype

Alternative commands are

| metadata type=sourcetypes index=test

or

| tstats count where index=test by sourcetype
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma
Highlighted

Re: How to list all sourcetypes

Path Finder

What I was looking for is closer to index="test" | stats dc(sourcetype) by sourcetype

but thanks I was able to find this because of your answer.

0 Karma