Splunk Search

How to extract all hosts and their sourcetypes?

sleathley
Explorer

Trying to right a search that will extract and display all the hosts that have indexed data and their sourcetypes. Anyone have any ideas?

Tags (1)

lguinn2
Legend

How you write the search depends on what you want. If you want to see how many events of each host/sourcetype combination, then you could use the following search

host=* | fields host sourcetype | stats count by host sourcetype

The fields command will make it run faster, but it will still be pretty slow because: if you want to see ALL the hosts, you will have to run this search over "All time".

In the Summary view of the Search app, you can see a list of hosts, sourcetypes and sources. If you want a list like that, you can get it pretty quickly by using one of the following searches:

| metadata type=hosts

| metadata type=sourcetypes

Yes, these searches are weird, they DO start with a pipe! You may want to use the table command to format the output. What these searches won't give you is "what are the sourcetypes that are associated with each host." But if you want a simple list, these searches will be much faster.

rossikwan
Path Finder

This is a slow way to list

"* | top sourcetypes by host"


host, sourcetype, count, percent

hostA, AAA, XXX, YY


0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...