To which index does the sourcetype belong?

[Neonbeeflash3]

Greetings,

I have been creating a search that collects all the sourcetypes that have not collected any information during the last 4 hours (Which I was able to accomplish). The thing is that I need to know which indexes these sourcetypes belong to in this same search. Any idea?

This is the search:

| metadata type=sourcetypes index=*
| search sourcetype=*
| where lastTime<now()-14400
| eval ageInSeconds = (now()- firstTime)
| search ageInSeconds > 86400
| convert ctime(lastTime) ctime(recentTime) ctime(firstTime)
| table sourcetype, lastTime

[richgalloway]

Sourcetypes do not "belong" to indexes.  There is no association between an index and a sourcetype other than one happened to found within the other.

If a sourcetype was not found during a particular period then it doesn't "belong" to any index in that period.

[Neonbeeflash3]

I'm sorry if I explained wrong, each of the sourcetypes that I can filter with this search are related to an index. What I would like to see is which index they are related to. For example, one of the sourcetypes I get is called "hello" (example names) and this sourcetype is related to an index called "goodbye". What I would like to see in this search is the index to which "hello" is related.

[richgalloway]

Any relationship between sourcetype and indexer is of your own making and so must be the solution.

Perhaps you can build a lookup table of sourcetypes and expected index(es).