i can do
| metadata type=sourcetypes |table sourcetype
but what i would like is the equivalent of:
| metadata type=sourcetypes index=* | table index sourcetype
however this does not work and does not enter data in the index column
How can i achieve this very simple list, preferably without using stats command
You can get a list of indexes like this:
| eventcount summarize=f index=* index=_* | dedup index | fields index
See http://splunk-base.splunk.com/answers/39370/is-it-possibl-to-get-a-list-of-available-indices
Your search doesn't work because metadata does not contain any field "index". It does give you the list of sourcetypes though.
This search worked better for me over the other tstats searches. The tstats search would generate errors over too long a time.