Splunk Search

useing metadata commend to display sourcetype host and sources at the same time

samlinsongguo
Communicator

HI
I want to use | metadata commend to display sourcetype host and sources at the same time, so far I cant make connection between them.
As we know when I run | metadata type=sourcetypes search it will return me sourcetype information,like below

firstTime   lastTime   recentTime sourcetype totalCount type
151572    1515399    152170     RT2RO   108      sourcetypes

the output I am looking for is

firstTime   lastTime   recentTime sourcetype totalCount source       host
  151572    1515399    152170       RT2RO   108     \var\log\a   rt2.server.com

Can this be done using | metadata command?
The reason I want to use it is just because it give result fast 🙂
Thanks in advance

0 Karma
1 Solution

adonio
Ultra Champion

hello there,
not sure how to achieve with | metadata (without | append or | appendcols ) but give ashot to the next search:
|tstats count as event_count min(_time) as firstTime max(_time) as lastTime by host source sourcetype where index=*

hope it helps

View solution in original post

0 Karma

adonio
Ultra Champion

hello there,
not sure how to achieve with | metadata (without | append or | appendcols ) but give ashot to the next search:
|tstats count as event_count min(_time) as firstTime max(_time) as lastTime by host source sourcetype where index=*

hope it helps

0 Karma

samlinsongguo
Communicator

Thanks Adonio, not very familiar with tstats but it got what I want thanks again.

0 Karma
Get Updates on the Splunk Community!

Splunk ITSI & Correlated Network Visibility

  Now On Demand   Take Your Network Visibility to the Next Level In today’s complex IT environments, ...

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...