How to show all sources for each index?

[BaptVe]

Hello,

I'm searching to show all source from indexes on a search form.

I'm able to extract the list of indexes with:

| eventcount summarize=false index=* index=_* | dedup index | fields index

and extract a list of sources with:

| chart count by source | sort count desc

But I can't figure out a way to add the source for each index.

Thanks for you help!

[somesoni2 · Accepted solution]

Try something like this

| tstats count WHERE index=* OR index=_* by index source 

OR (slower)

 | eventcount summarize=false index=* index=_* | dedup index | fields index | map maxsearches=100 search="| metadata type=sources index=$index$ | table source | eval index=\"$index$\""

[BaptVe]

Exactly what i was looking for, thanks

3 columns :
Index | source | count

It repeats the index for each source and count how much time it shows it

Thanks !

[Jeremiah]

Ah I always forget about tstats. Yes that's probably the fastest way to get the data.

[Jeremiah]

Try using metasearch:

| metasearch index=* | chart count over source by index

If you have a large environment that search can take a long time. We actually summarize that data so we can search if more quickly.

Or you can use your license data if it contains both source and index. This will have volume (in bytes) not event count. There's a point at which the license data will only record sourcetype (due to the number of combinations of host, source, sourcetype and index), so this may not work.

index=_internal  source=*license_usage.log  | chart sum(b) over s by idx