Getting Data In

How to create a report about each index and the sourcetypes it contains?

giy4
Engager

I need to create a report that shows each index on my system and the relevant data about sourcetypes within the index. I know I can use |metadata type=sourcetypes index=myindex and get the information for a specific index, but I want to basically pull all of my indexes and run that command for each of the indexes I have.

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Ok, so here you go. This uses the rest command, and the metadata command. It will increase in execution time as the number of indexes increases.

|rest /services/data/indexes count=0 | dedup title | fields title | map  [|metadata type=sourcetypes index="$title$" | eval type="$title$"] maxsearches=1000 | stats values(totalCount) by sourcetype type | rename type as index
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...