Get Sourcetype and Index Info via TSTATS _internal john117 Vote Up +10 Vote Down -0You already voted! Use the following simple tstats query to return the latest time events came in for a given index as well as list all sourcetypes for each index: |tstats values(sourcetype) as Sourcetype latest(_time) as Time groupby index | convert ctime(Time) Share This: Tagged: Diagnosticsfastinternaltroubleshoottstats