sourcetypes

[verifi81]

Is there a way to tell which method a sourcetype is using to get data into splunk? 

For example, suppose I look at the sourcetype of an index named main

|metadata type=sourcetype index=main

It display a list of sourcetypes but I want to know if those sourtypes of syslog, from a heavy forwarder, or from a universal forwarder.  Is that possible? 

[thambisetty]

AFAIK, There is no direct way to identify this. you can identify using 

index=_internal group=per_sourcetype_thruput sourcetype=splunkd host=<excludeyourindexers> | stats count by host,series
| table host,series | rename series as sourcetype

[isoutamo]

That's good starting point. Unfortunately it shows only 10 most busiest sourcetypes by default.

https://docs.splunk.com/Documentation/Splunk/8.1.0/Troubleshooting/Aboutmetricslog
Unfortunately I couldn't recall any better way at this point.