Unfortunately, this is not an easy question to answer, as there's not a single query that can pull everything up that's in your environment. As for integrating more things with Splunk, that is part of the administrative function of the platform, and usually requires more information. my suggestion is to read the documentation that was suggested in the answer by ChrisG. If you want a visual then set your time range for 24 hours and use these two queries: index=* sourcetype=* | stats count by sourcetype index=* sourcetype=* | stats count by source This will give you the data sets, and the sources that are in your splunk environment. You'll also quickly realize why the answer to this question is not as easy as 1 query. ... View more