Splunk Search

Metadata Search (Index Selector)

JoeSco27
Communicator

I am trying to create a utility using the metadata command that will allow me to see what sourcetypes exist by index. I have started with a command that returns all the sourcetypes for an index i enter into the search, but i am trying to create a report where i can select the index from a dropdown. my search thus far looks like this:

[|metadata type=sourcetypes index="$index$" | search totalCount>0 | rename totalCount as Count recentTime as "Last Update" | table sourcetype Count "Last Update" | fieldformat Count=tostring(Count, "commas") | fieldformat "Last Update"=strftime('Last Update', "%c")]

above that in the XML, fieldset, i have put in this but it doesnt seem to return any values.

< fieldset >
  < input type="dropdown" token="$index$" >
    < label>Select Index</label >
     < choice search="index=main">Main</choice >
     < choice search="index=iis">IIS</choice >
   < /input >
 < /fieldset >

The entire search works when I dont have "$index$" in the search, but i am trying to dynamically be able to change that value from the dropdown

Tags (1)
0 Karma
1 Solution

linu1988
Champion

As you mentioned in the choice parameter Main will be equal to "index=main". But your search definition is [|metadata type=sourcetypes index="$index$"

which leads to :
[|metadata type=sourcetypes index="index=main"!!!
is it correct? do replace it by only "main" and check..

View solution in original post

linu1988
Champion

Please mark it as an answer as it's the solution:)

0 Karma

JoeSco27
Communicator

Thank you, i think that got it working now

0 Karma

linu1988
Champion

As you mentioned in the choice parameter Main will be equal to "index=main". But your search definition is [|metadata type=sourcetypes index="$index$"

which leads to :
[|metadata type=sourcetypes index="index=main"!!!
is it correct? do replace it by only "main" and check..

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

The Data Connection - October 2026

We all have data. Lots of it. But that’s not the problem – it’s understanding what we should we do with it, ...

Beyond the Acceleration Zone: Maximizing Your Success with Splunk Customer Experience ...

Customer success is built on tailored guidance and accessible resources. As a Splunk user, you are encouraged ...

Make your Splunk investment work harder with Optimization Advisor

Value Insights brings usage evidence and practical recommendations together to help customers make more ...