Splunk Search

How to show all sources for each index?

Path Finder

Hello,

I'm searching to show all source from indexes on a search form.

I'm able to extract the list of indexes with:

| eventcount summarize=false index=* index=_* | dedup index | fields index

and extract a list of sources with:

| chart count by source | sort count desc

But I can't figure out a way to add the source for each index.

Thanks for you help!

Tags (4)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try something like this

| tstats count WHERE index=* OR index=_* by index source 

OR (slower)

 | eventcount summarize=false index=* index=_* | dedup index | fields index | map maxsearches=100 search="| metadata type=sources index=$index$ | table source | eval index=\"$index$\""

View solution in original post

SplunkTrust
SplunkTrust

Try something like this

| tstats count WHERE index=* OR index=_* by index source 

OR (slower)

 | eventcount summarize=false index=* index=_* | dedup index | fields index | map maxsearches=100 search="| metadata type=sources index=$index$ | table source | eval index=\"$index$\""

View solution in original post

Path Finder

Exactly what i was looking for, thanks

3 columns :
Index | source | count

It repeats the index for each source and count how much time it shows it

Thanks !

0 Karma

Motivator

Ah I always forget about tstats. Yes that's probably the fastest way to get the data.

0 Karma

Motivator

Try using metasearch:

| metasearch index=* | chart count over source by index

If you have a large environment that search can take a long time. We actually summarize that data so we can search if more quickly.

Or you can use your license data if it contains both source and index. This will have volume (in bytes) not event count. There's a point at which the license data will only record sourcetype (due to the number of combinations of host, source, sourcetype and index), so this may not work.

index=_internal  source=*license_usage.log  | chart sum(b) over s by idx