Splunk Search

Metadata Search (Index Selector)

JoeSco27
Communicator

I am trying to create a utility using the metadata command that will allow me to see what sourcetypes exist by index. I have started with a command that returns all the sourcetypes for an index i enter into the search, but i am trying to create a report where i can select the index from a dropdown. my search thus far looks like this:

[|metadata type=sourcetypes index="$index$" | search totalCount>0 | rename totalCount as Count recentTime as "Last Update" | table sourcetype Count "Last Update" | fieldformat Count=tostring(Count, "commas") | fieldformat "Last Update"=strftime('Last Update', "%c")]

above that in the XML, fieldset, i have put in this but it doesnt seem to return any values.

< fieldset >
  < input type="dropdown" token="$index$" >
    < label>Select Index</label >
     < choice search="index=main">Main</choice >
     < choice search="index=iis">IIS</choice >
   < /input >
 < /fieldset >

The entire search works when I dont have "$index$" in the search, but i am trying to dynamically be able to change that value from the dropdown

Tags (1)
0 Karma
1 Solution

linu1988
Champion

As you mentioned in the choice parameter Main will be equal to "index=main". But your search definition is [|metadata type=sourcetypes index="$index$"

which leads to :
[|metadata type=sourcetypes index="index=main"!!!
is it correct? do replace it by only "main" and check..

View solution in original post

linu1988
Champion

Please mark it as an answer as it's the solution:)

0 Karma

JoeSco27
Communicator

Thank you, i think that got it working now

0 Karma

linu1988
Champion

As you mentioned in the choice parameter Main will be equal to "index=main". But your search definition is [|metadata type=sourcetypes index="$index$"

which leads to :
[|metadata type=sourcetypes index="index=main"!!!
is it correct? do replace it by only "main" and check..

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Rounding off the Splunk Dashboard Contest

What does a contest-winning Splunk dashboard look like? In this case, it isn't in a browser tab at all. It ...

A Four Part Event Series: AI + Observability: AI Agents, LLMs, Apps, & Infrastructure

AI &#43; Observability: AI Agents, LLMs, Apps, & Infrastructure The rapid evolution of artificial intelligence ...