Knowledge Management

Overview of events and feeds coming in

ecanmaster
Explorer

Is there a quick way on getting a list of all events coming in and all feeds coming in?

Would it also be possible to see which feeds are being used for the data models?
And also getting a list of feeds that are not being used in searches?

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

There are apps for this kind of thing on splunkbase. You can start with this:

index=* | stats values(tag) BY sourcetype

The tags will indicate which datamodels each sourcetype goes into.

View solution in original post

0 Karma

woodcock
Esteemed Legend

There are apps for this kind of thing on splunkbase. You can start with this:

index=* | stats values(tag) BY sourcetype

The tags will indicate which datamodels each sourcetype goes into.

0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...