Hi,
I am using the following search | metadata type=sourcetype| where match(sources)
to find all the sources that a particular sourcetype has. Can someone please help in the correcting the search?
Try
| metadata type=sources sourcetype=*
You need another s
for starters but you cannot do what you are trying to do with the command that you are trying to use. See what I mean with these:
| metadata type=sources index=* OR index=_*
| metadata type=sourcetypes index=* OR index=_*
But you can do it with tstats
like this:
| tstats values(source) WHERE index=* OR index=_* BY sourcetype
Hi kteng2024, You might find tstats
would work better here. i.e.
| tstats count where sourcetype=YOUR_SOURCETYPE by source
This will give you a list sources for that sourcetype. It should be fairly quick to run over large timeframes.
Please let me know if this answers your question! 😄
If you're collecting data for all sourcetypes then use this variation.
| tstats max(_time) as recentTime where index=* by sourcetype source