SPL
Show all Indexes and Sourcetypes via REST
Description
The following Splunk query uses REST to display non internal indexes associated with sourcetypes. It is my understanding that this is all time (such is the way of REST searches)
3 0
| rest /services/data/inputs/all | search index!=_* | stats values(sourcetype) by index
Comments
0 total
Be the first to comment on this SPL.
Leave a comment
You must log in to post a comment.