Splunk Search

How to generate a search to find the all the indexes and their sourcetypes without using a wildcard?

kteng2024
Path Finder

hi,

i would like to know the search to find all the indexes and their sourcetypes . But my search is:

index=* | dedup sourcetype | table sourcetype 

and i selected " ALL TIME" . So, is there any other way to find out the indexes and their sourcetypes without using a wildcard and ALL TIME?

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@kteng2024 - Looks like you have a few possible solutions to your question. If one of them provided a working solution, please don't forget to click "Accept" below the best answer to resolve this post. If you still need help, please leave a comment. Don’t forget to upvote anything that was helpful too. Thanks!

0 Karma

mgrosholz
Path Finder

So your search might be cumbersome because you are not using metadata. Metadata is perfect for this instance and does not require Splunk to search all indexes at search time.

You should use something like this...

 | metadata type=sourcetypes index=*

Much like others above have mentioned.

0 Karma

niketn
Legend

If you are just trying to find all the sourcetypes you can also try metadata command

| metadata type=sourcetypes index=* 
| table sourcetype
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

DalJeanis
Legend

s2_splunk
Splunk Employee
Splunk Employee

Try this | tstats values(sourcetype) where index=* by index

It uses index files only, so it should complete pretty quickly without having to scan all of your data.

Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...