Splunk Search

Metadata Search (Index Selector)

JoeSco27
Communicator

I am trying to create a utility using the metadata command that will allow me to see what sourcetypes exist by index. I have started with a command that returns all the sourcetypes for an index i enter into the search, but i am trying to create a report where i can select the index from a dropdown. my search thus far looks like this:

[|metadata type=sourcetypes index="$index$" | search totalCount>0 | rename totalCount as Count recentTime as "Last Update" | table sourcetype Count "Last Update" | fieldformat Count=tostring(Count, "commas") | fieldformat "Last Update"=strftime('Last Update', "%c")]

above that in the XML, fieldset, i have put in this but it doesnt seem to return any values.

< fieldset >
  < input type="dropdown" token="$index$" >
    < label>Select Index</label >
     < choice search="index=main">Main</choice >
     < choice search="index=iis">IIS</choice >
   < /input >
 < /fieldset >

The entire search works when I dont have "$index$" in the search, but i am trying to dynamically be able to change that value from the dropdown

Tags (1)
0 Karma
1 Solution

linu1988
Champion

As you mentioned in the choice parameter Main will be equal to "index=main". But your search definition is [|metadata type=sourcetypes index="$index$"

which leads to :
[|metadata type=sourcetypes index="index=main"!!!
is it correct? do replace it by only "main" and check..

View solution in original post

linu1988
Champion

Please mark it as an answer as it's the solution:)

0 Karma

JoeSco27
Communicator

Thank you, i think that got it working now

0 Karma

linu1988
Champion

As you mentioned in the choice parameter Main will be equal to "index=main". But your search definition is [|metadata type=sourcetypes index="$index$"

which leads to :
[|metadata type=sourcetypes index="index=main"!!!
is it correct? do replace it by only "main" and check..

Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...