Splunk Search

Searches

whitecat001
Explorer

what command can i run if am not sure where an index for a data associated with a sourcetype is stored in splunk

Labels (1)
0 Karma

marysan
Communicator

there are several queries :
for example sourcetype=Sample_sourcetype : 
1-

| metadata type=sourcetypes
| search sourcetype=Sample_sourcetype
| table index, sourcetype


2-

| tstats count where sourcetype=Sample_sourcetype by index | table index

 

Tags (2)
0 Karma

antoniolamonica
Explorer

you could try:

index=*
| stats values(sourcetype) as sourcetype by index
| table index, sourcetype


this will provide all sourcetypes associated to their index, based on the timeframe given and if they contain event logs during that time frame. 

Tags (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @whitecat001,

you could try:

index=* sourcetype=your_sourcetype

in this way you can know which is the index.

Ciao.

Giuseppe

0 Karma

whitecat001
Explorer

thank you

0 Karma

deepakc
Builder
| tstats count where index=* by index, sourcetype
0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...