Hello,
I'm searching to show all source from indexes on a search form.
I'm able to extract the list of indexes with:
| eventcount summarize=false index=* index=_* | dedup index | fields index
and extract a list of sources with:
| chart count by source | sort count desc
But I can't figure out a way to add the source for each index.
Thanks for you help!
Try something like this
| tstats count WHERE index=* OR index=_* by index source
OR (slower)
| eventcount summarize=false index=* index=_* | dedup index | fields index | map maxsearches=100 search="| metadata type=sources index=$index$ | table source | eval index=\"$index$\""
Try something like this
| tstats count WHERE index=* OR index=_* by index source
OR (slower)
| eventcount summarize=false index=* index=_* | dedup index | fields index | map maxsearches=100 search="| metadata type=sources index=$index$ | table source | eval index=\"$index$\""
Exactly what i was looking for, thanks
3 columns :
Index | source | count
It repeats the index for each source and count how much time it shows it
Thanks !
Ah I always forget about tstats. Yes that's probably the fastest way to get the data.
Try using metasearch:
| metasearch index=* | chart count over source by index
If you have a large environment that search can take a long time. We actually summarize that data so we can search if more quickly.
Or you can use your license data if it contains both source and index. This will have volume (in bytes) not event count. There's a point at which the license data will only record sourcetype (due to the number of combinations of host, source, sourcetype and index), so this may not work.
index=_internal source=*license_usage.log | chart sum(b) over s by idx