Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to get all indexes and sourcetypes?

$
0
0
After browsing through Splunk Answers, the closest I could get is the following SPL to list all Indexes and Sourcetypes in a single table - | eventcount summarize=false index=* index!=_* | dedup index | fields index | map maxsearches=100 search="| metadata type=sourcetypes index=\"$index$\" | eval retention=tostring(abs(lastTime-firstTime), \"duration\") | convert ctime(firstTime) ctime(lastTime) | sort lastTime | rename totalCount AS \"TotalEvents\" firstTime AS \"FirstEvent\" lastTime AS \"LastEvent\" | eval index=\"$index$\"" | rename index as "Index" "sourcetype" as "SourceType" | fields Index SourceType TotalEvents FirstEvent LastEvent I want to provide the users with the ability to filter by indexes and sourcetypes. Here is what I have so far -
| rest /servicesNS/-/-/data/indexes|rename "title" as index | eval dy = (frozenTimePeriodInSecs/86400) % 365 | eval retention = dy . " days" | dedup index | stats count by indexindexindexALL"\""$index$\"""\"$index$\"| metadata type=sourcetypes index=* | stats count by sourcetypesourcetypesourcetype()SourceType= OR ALL**
| eventcount summarize=false index=* index!=_* | dedup index | fields index | map maxsearches=100 search="| metadata type=sourcetypes index=\"$index$\" | eval retention=tostring(abs(lastTime-firstTime), \"duration\") | convert ctime(firstTime) ctime(lastTime) | sort lastTime | rename totalCount AS \"TotalEvents\" firstTime AS \"FirstEvent\" lastTime AS \"LastEvent\" | eval index=\"$index$\"" | rename index as "Index" "sourcetype" as "SourceType" | fields Index SourceType TotalEvents FirstEvent LastEvent | search $source_type$-3d@dnow
I am unable to achieve 2 things here - 1. When I filter indexes, I want the respective sourcetypes to be filtered in the sourctypes dropdown 2. Display the table with selected indexes and sourcetypes only (should be able to select multiple in both case) The query seems to be slow, but it gives the expected output. Any advice? Thanks!

Viewing all articles
Browse latest Browse all 47296

Trending Articles