Getting Data In

How to list defined sourcetypes through API

jbanker
Explorer

I am looking for a way to list all defined sourcetypes on a Splunk server, using the REST API.

From what little information I can find, it looks like it would be possible to crawl through the configuration files and look for defined sourcetypes, but I'm hoping there is an easier way.

0 Karma
1 Solution

jbanker
Explorer

So, I found my own answer. For anyone looking to solve this same problem in the future, I used:

https://splunkHost:8089/services/saved/sourcetypes?output_mode=json&count=1000

This gives a nice JSON parseable output of all the defined sourcetypes for a specific instance.

View solution in original post

jbanker
Explorer

So, I found my own answer. For anyone looking to solve this same problem in the future, I used:

https://splunkHost:8089/services/saved/sourcetypes?output_mode=json&count=1000

This gives a nice JSON parseable output of all the defined sourcetypes for a specific instance.

traxxasbreaker
Communicator

From the search bar, try something like this as a starting point:

| rest /servicesNS/-/-/configs/conf-props

Note that if you are in a distributed environment, you might have to specify a splunk_server in your REST call to look at the part of the environment that your sourcetype is defined on (such as an indexer or heavy forwarder).

If you want to look at it from the CLI instead, you would do something like this:

curl -k -u : https://splunkHost:8089/services/configs/conf-props

0 Karma

jbanker
Explorer

So, it looks like this can give me the sourcetypes that are currently in use by the configured inputs. Unfortunately as I stated, I'm looking to get a list of ALL configured sourcetypes available on a server. What I'm hoping to get is a list similar to what can be seen in the UI when you navigate to "Settings > Source types" or "https://splunkHost/en-US/manager/launcher/sourcetypes"

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...