Splunk Search

How to extract all hosts and their sourcetypes?

sleathley
Explorer

Trying to right a search that will extract and display all the hosts that have indexed data and their sourcetypes. Anyone have any ideas?

Tags (1)

lguinn2
Legend

How you write the search depends on what you want. If you want to see how many events of each host/sourcetype combination, then you could use the following search

host=* | fields host sourcetype | stats count by host sourcetype

The fields command will make it run faster, but it will still be pretty slow because: if you want to see ALL the hosts, you will have to run this search over "All time".

In the Summary view of the Search app, you can see a list of hosts, sourcetypes and sources. If you want a list like that, you can get it pretty quickly by using one of the following searches:

| metadata type=hosts

| metadata type=sourcetypes

Yes, these searches are weird, they DO start with a pipe! You may want to use the table command to format the output. What these searches won't give you is "what are the sourcetypes that are associated with each host." But if you want a simple list, these searches will be much faster.

rossikwan
Path Finder

This is a slow way to list

"* | top sourcetypes by host"


host, sourcetype, count, percent

hostA, AAA, XXX, YY


0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...