Splunk Search

Metadata Search (Index Selector)

JoeSco27
Communicator

I am trying to create a utility using the metadata command that will allow me to see what sourcetypes exist by index. I have started with a command that returns all the sourcetypes for an index i enter into the search, but i am trying to create a report where i can select the index from a dropdown. my search thus far looks like this:

[|metadata type=sourcetypes index="$index$" | search totalCount>0 | rename totalCount as Count recentTime as "Last Update" | table sourcetype Count "Last Update" | fieldformat Count=tostring(Count, "commas") | fieldformat "Last Update"=strftime('Last Update', "%c")]

above that in the XML, fieldset, i have put in this but it doesnt seem to return any values.

< fieldset >
  < input type="dropdown" token="$index$" >
    < label>Select Index</label >
     < choice search="index=main">Main</choice >
     < choice search="index=iis">IIS</choice >
   < /input >
 < /fieldset >

The entire search works when I dont have "$index$" in the search, but i am trying to dynamically be able to change that value from the dropdown

Tags (1)
0 Karma
1 Solution

linu1988
Champion

As you mentioned in the choice parameter Main will be equal to "index=main". But your search definition is [|metadata type=sourcetypes index="$index$"

which leads to :
[|metadata type=sourcetypes index="index=main"!!!
is it correct? do replace it by only "main" and check..

View solution in original post

linu1988
Champion

Please mark it as an answer as it's the solution:)

0 Karma

JoeSco27
Communicator

Thank you, i think that got it working now

0 Karma

linu1988
Champion

As you mentioned in the choice parameter Main will be equal to "index=main". But your search definition is [|metadata type=sourcetypes index="$index$"

which leads to :
[|metadata type=sourcetypes index="index=main"!!!
is it correct? do replace it by only "main" and check..

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Where Innovation Takes Flight: The Splunk4Aviation Flight Sim Lands at .conf26

If you hear someone at .conf26 shouting "gear down, GEAR DOWN" across the show floor, you have found us.  The ...

Turn Cisco Telemetry Into Action with Cisco Data Fabric, powered by the Splunk ...

The surge in machine data is already hitting enterprise budgets, and the agentic era will only intensify it. ...

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...