Splunk Search

sourcetypes

verifi81
Path Finder

Is there a way to tell which method a sourcetype is using to get data into splunk? 

For example, suppose I look at the sourcetype of an index named main

|metadata type=sourcetype index=main

It display a list of sourcetypes but I want to know if those sourtypes of syslog, from a heavy forwarder, or from a universal forwarder.  Is that possible? 

0 Karma

thambisetty
SplunkTrust
SplunkTrust

AFAIK, There is no direct way to identify this. you can identify using 

index=_internal group=per_sourcetype_thruput sourcetype=splunkd host=<excludeyourindexers> | stats count by host,series
| table host,series | rename series as sourcetype
————————————
If this helps, give a like below.
0 Karma

isoutamo
SplunkTrust
SplunkTrust
That's good starting point. Unfortunately it shows only 10 most busiest sourcetypes by default.

https://docs.splunk.com/Documentation/Splunk/8.1.0/Troubleshooting/Aboutmetricslog
Unfortunately I couldn't recall any better way at this point.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...