index=* |stats count by sourcetype |table index sourcetype count
The above query displays the sourcetype and count details, but not the index details, Please help me figure out how to proceed.
You might want to look at this free course as well: https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html
Hi
try like
index=* |stats count by sourcetype, index
Fixed.. Don't use index=*
when searching over index time fields
| metasearch
| stats count by sourcetype, index
|metasearch index=* | stats count by sourcetype, index
is working fine