Splunk Search

How to extract all hosts and their sourcetypes?

sleathley
Explorer

Trying to right a search that will extract and display all the hosts that have indexed data and their sourcetypes. Anyone have any ideas?

Tags (1)

lguinn2
Legend

How you write the search depends on what you want. If you want to see how many events of each host/sourcetype combination, then you could use the following search

host=* | fields host sourcetype | stats count by host sourcetype

The fields command will make it run faster, but it will still be pretty slow because: if you want to see ALL the hosts, you will have to run this search over "All time".

In the Summary view of the Search app, you can see a list of hosts, sourcetypes and sources. If you want a list like that, you can get it pretty quickly by using one of the following searches:

| metadata type=hosts

| metadata type=sourcetypes

Yes, these searches are weird, they DO start with a pipe! You may want to use the table command to format the output. What these searches won't give you is "what are the sourcetypes that are associated with each host." But if you want a simple list, these searches will be much faster.

rossikwan
Path Finder

This is a slow way to list

"* | top sourcetypes by host"


host, sourcetype, count, percent

hostA, AAA, XXX, YY


0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...