How to write a search which lists out the indexes, hosts, sourcetypes of the events with TIME_FORMAT = %m/%d/%y?

[pavanae]

I have all the events logging from Linux were in the TIME_FORMAT = %d/%m/%y and Windows events were in TIME_FORMAT = %m/%d/%y. Now I need to list out all the Windows events which were logging into Splunk with the time format TIME_FORMAT = %m/%d/%y.

By using the below search string, I am able to list out out all the indexes and their hosts and their sourcetypes. Now I need only the list of events with TIME_FORMAT = %m/%d/%y only.

| tstats values(host) AS Host, values(sourcetype) AS Sourcetype WHERE index=* by index

[vasanthmss · Accepted solution]

I guess there is no straight way to identify this.

you can try something like this,,

Below search gives you the list of host has windows operating system.

index=_internal source=*metrics.log os=Windows earliest=-1h@h   | dedup host | table host

If the above list of servers are correct then run the below search to get the index, source, sourcetype details.
Overall Query

  | tstats values(host) AS Host, values(sourcetype) AS Sourcetype WHERE index=* [search index=_internal source=*metrics.log os=Windows earliest=-1h@h   | dedup host | table host] by index

Hope this will helps you.

[pavanae]

Thanks like in the same is there any search which gives the list of host has Linux operating system.

[vasanthmss]

index=_internal source=*metrics.log (os=Linux OR os=AIX)  earliest=-1h@h   | dedup host | table host

[richgalloway]

Are you trying to change the output format or do you want to search for data in a particular format?

[pavanae]

I want to search the date in particular format. like the date with timestamp format TIME_FORMAT = %m/%d/%y and not TIME_FORMAT = %d/%m/%y