This will give you a list of hosts:
index=_internal source="C:\\Program Files\\Splunk\\var\\log\\splunk\\metrics.log" group=per_host_thruput|dedup series|table series|rename series AS Host
This will give you a list of sourcetypes:
index=_internal source="C:\\Program Files\\Splunk\\var\\log\\splunk\\metrics.log" group=per_sourcetype_thruput |dedup series|table series|rename series AS Sourcetype
Both of these searches are fast, but I've not figured out a way to combine them to get a list of sourcetypes per host.
This search will give you a list of sourcetypes by host, but it can be slow. One way to make it faster is to run the search in Fast Mode:
index="*" NOT index=_internal |fields + host sourcetype| dedup host sourcetype|table host by sourcetype
