Ad slot: top

SPL

Show all Indexes and Sourcetypes via REST

Description

Submitted by ItsJohnLocke

The following Splunk query uses REST to display non internal indexes associated with sourcetypes. It is my understanding that this is all time (such is the way of REST searches)
3 0
| rest /services/data/inputs/all
| search index!=_*
| stats values(sourcetype) by index

Comments

0 total

Be the first to comment on this SPL.

Leave a comment

You must log in to post a comment.

Ad slot: bottom