Knowledge Management

Overview of events and feeds coming in

ecanmaster
Explorer

Is there a quick way on getting a list of all events coming in and all feeds coming in?

Would it also be possible to see which feeds are being used for the data models?
And also getting a list of feeds that are not being used in searches?

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

There are apps for this kind of thing on splunkbase. You can start with this:

index=* | stats values(tag) BY sourcetype

The tags will indicate which datamodels each sourcetype goes into.

View solution in original post

0 Karma

woodcock
Esteemed Legend

There are apps for this kind of thing on splunkbase. You can start with this:

index=* | stats values(tag) BY sourcetype

The tags will indicate which datamodels each sourcetype goes into.

View solution in original post

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!