Skip to content

Instantly share code, notes, and snippets.

@EatMoreChicken

EatMoreChicken/Splunk_Search_SourceType_App.md

Last active November 3, 2023 13:51
Show Gist options
  • Save EatMoreChicken/a4b508134ffc401e9875847cd4edc455 to your computer and use it in GitHub Desktop.
Save EatMoreChicken/a4b508134ffc401e9875847cd4edc455 to your computer and use it in GitHub Desktop.
Download ZIP
Splunk Search to Find SourceTypes without Corresponding Apps
Raw
Splunk_Search_SourceType_App.md

When run from a Splunk search head, this search will return sourcetypes seen that do not have apps with configs for the listed sourcetype.

For example, if it returns WinEventLog, you should download the Windows TA to perform search-time parsing for these events.

| tstats c where index=* by sourcetype 
| append 
    [| rest /services/saved/sourcetypes splunk_server=local 
    | fields title eai:acl.app 
    | rename title as sourcetype, eai:acl.app as app 
    | search (NOT app IN ("system", "learned"))]
| stats c values(app) as app by sourcetype
| where c=1 AND isnull(app)
| fields - c app
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment