Hello splunk community, I have this query but I would also like to retrieve the index to which the sourcetype belongs
index=_internal splunk_server=* source=*splunkd.log* sourcetype=splunkd
(component=AggregatorMiningProcessor OR component=LineBreakingProcessor OR component=DateParserVerbose OR component=MetricSchemaProcessor OR component=MetricsProcessor) (log_level=WARN OR log_level=ERROR OR log_level=FATAL)
| rex field=event_message "\d*\|(?<st>[\w\d:-]*)\|\d*"
| eval data_sourcetype=coalesce(data_sourcetype, st)
| rename data_sourcetype as sourcetype
| table sourcetype event_message component thread_name _time _raw
| stats first(event_message) as event_message by sourcetype component
any ideas ? thx in advance
... View more