Splunk Search

How to show all sources for each index?

BaptVe
Path Finder

Hello,

I'm searching to show all source from indexes on a search form.

I'm able to extract the list of indexes with:

| eventcount summarize=false index=* index=_* | dedup index | fields index

and extract a list of sources with:

| chart count by source | sort count desc

But I can't figure out a way to add the source for each index.

Thanks for you help!

Tags (4)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try something like this

| tstats count WHERE index=* OR index=_* by index source 

OR (slower)

 | eventcount summarize=false index=* index=_* | dedup index | fields index | map maxsearches=100 search="| metadata type=sources index=$index$ | table source | eval index=\"$index$\""

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Try something like this

| tstats count WHERE index=* OR index=_* by index source 

OR (slower)

 | eventcount summarize=false index=* index=_* | dedup index | fields index | map maxsearches=100 search="| metadata type=sources index=$index$ | table source | eval index=\"$index$\""

BaptVe
Path Finder

Exactly what i was looking for, thanks

3 columns :
Index | source | count

It repeats the index for each source and count how much time it shows it

Thanks !

0 Karma

Jeremiah
Motivator

Ah I always forget about tstats. Yes that's probably the fastest way to get the data.

0 Karma

Jeremiah
Motivator

Try using metasearch:

| metasearch index=* | chart count over source by index

If you have a large environment that search can take a long time. We actually summarize that data so we can search if more quickly.

Or you can use your license data if it contains both source and index. This will have volume (in bytes) not event count. There's a point at which the license data will only record sourcetype (due to the number of combinations of host, source, sourcetype and index), so this may not work.

index=_internal  source=*license_usage.log  | chart sum(b) over s by idx
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...