How to list all sourcetypes

[ialahdal]

I am trying to list all sourcetypes in an index using dc
Using index="test" | stats dc(sourcetype) as sourcetypesonly shows the total number of sourcetypes but does not list them individually.

[richgalloway · Accepted solution]

To list them individually you must tell Splunk to do so.

index="test" | stats count by sourcetype

Alternative commands are

| metadata type=sourcetypes index=test

or

| tstats count where index=test by sourcetype

[ialahdal]

What I was looking for is closer to index="test" | stats dc(sourcetype) by sourcetype

but thanks I was able to find this because of your answer.