Splunk Search

Searches

whitecat001
Explorer

what command can i run if am not sure where an index for a data associated with a sourcetype is stored in splunk

Labels (1)
0 Karma

marysan
Communicator

there are several queries :
for example sourcetype=Sample_sourcetype : 
1-

| metadata type=sourcetypes
| search sourcetype=Sample_sourcetype
| table index, sourcetype


2-

| tstats count where sourcetype=Sample_sourcetype by index | table index

 

Tags (2)
0 Karma

antoniolamonica
Explorer

you could try:

index=*
| stats values(sourcetype) as sourcetype by index
| table index, sourcetype


this will provide all sourcetypes associated to their index, based on the timeframe given and if they contain event logs during that time frame. 

Tags (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @whitecat001,

you could try:

index=* sourcetype=your_sourcetype

in this way you can know which is the index.

Ciao.

Giuseppe

0 Karma

whitecat001
Explorer

thank you

0 Karma

deepakc
Builder
| tstats count where index=* by index, sourcetype
0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...