I am able to get a list of indexes and their source types using | metadata type=sources index=* sourcetype=* ||dedup source, but I want to add the source types to the list and be able to pick the index from a drop-down so that I get only the source types and sources for a particular index.
Thank you for the guide below, but oddly even when I added the dropdown it's not affecting the search. This is one Panel in a dashboard, do I have to do something different to make it work there?
Try this ,
|tstats count by index,source,sourcetype|fields - count
if you have the index selected, then you could filter by
|tstats count where index=your_selected_index by source,sourcetype|fields - count
Try this search over a time window long enough to get all of the possible indexes, sources, and sourcetypes. Save it to a dashboard panel:
index=* | stats count by index sourcetype source
Add a dropdown input to your dashboard with this configuration:
Click on the magnifying glass at the top of your dashboard panel when in Edit mode to edit the search. Modify the search to use your token for the index value:
index=$myindex$ | stats count by index sourcetype source