Trying to right a search that will extract and display all the hosts that have indexed data and their sourcetypes. Anyone have any ideas?
How you write the search depends on what you want. If you want to see how many events of each host/sourcetype combination, then you could use the following search
host=* | fields host sourcetype | stats count by host sourcetype
The fields command will make it run faster, but it will still be pretty slow because: if you want to see ALL the hosts, you will have to run this search over "All time".
In the Summary view of the Search app, you can see a list of hosts, sourcetypes and sources. If you want a list like that, you can get it pretty quickly by using one of the following searches:
| metadata type=hosts
| metadata type=sourcetypes
Yes, these searches are weird, they DO start with a pipe! You may want to use the table command to format the output. What these searches won't give you is "what are the sourcetypes that are associated with each host." But if you want a simple list, these searches will be much faster.
This is a slow way to list
"* | top sourcetypes by host"
host, sourcetype, count, percent
hostA, AAA, XXX, YY