Splunk Search

How to write a query required for checking all sourcetype which is configured for alert/report/dashboard

sanket4147
Loves-to-Learn Lots

Hi Team,

We are using Splunk Enterprise SIEM tool. we want to check all the source type which is configured for all alert/dashboard/report . As we have searched and tried with below query but it is not showing expected result which we want.

 

index="*" | stats count by source type

 

We want to check all source type which is configured under the all reports or all dashboards or all alerts.

if you can give me 3 different query for this then it is also fine we are not required all this in one query.

Could you please suggest and help us for this .

 

Regards,

Sanket Kaware 

 

 

 

 

 

Labels (2)
Tags (1)
0 Karma

PickleRick
Ultra Champion

I'm not really sure what you want to achieve.

The fastest way to get metadata for events is... the metadata command 🙂 For example

| metadata type=sourcetypes index=*

Unfortunately, it will not break the data into separate indexes or hosts.

If you want to make statistics on your own, you can use tstats (don't use stats for it! tstats is way way faster than stats). For example

| tstats count where index=* by host

or

| tstats count where index=* by sources sourcetypes

 Don't forget to adjust your timerange picker!

0 Karma
Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...