List of index, sourcetype & fields [ Edited ]

[#1]

When you want to build custom searches, a question that is quickly raised is: what are the indexes, sourcetype & fields I can use.

Here is how to generate the map of your reporting data for NIOS 7.3 and newer. For your convenience, results from our test NIOS 8.0 environment are attached in csv format.

1) Indexes & sourcetypes:

| eventcount summarize=false index=* | dedup index | fields index 

 | map maxsearches=100 search="|metadata type=sourcetypes index=\"$index$\" | eval index=\"$index$\""

 | fields index sourcetype

2) indexes, sourcetypes & fields:

| tstats count WHERE index=* GROUPBY index, sourcetype

 | fields - count

 | rename index AS indexname, sourcetype AS sourcetypename

 | map maxsearches=30 search="| search index=\"$indexname$\" sourcetype=\"$sourcetypename$\" | head 1000 | fieldsummary | eval index=\"$indexname$\", sourcetype=\"$sourcetypename$\" | fields index, sourcetype, field"

3) all values for a given field

Let us look for all the ACTION field values. If we filter on field "ACTION" it the previous file:

It exists in multiple indexes, so you should review to the index you are looking for:

index=ib_audit | stats values(ACTION)

index-sourcetype-field.csv.txt ‏50 KB

index-sourcetype.csv.txt ‏1 KB

[#2]

Thank you! This is great information. What about the size of the Grid Replication Queue? This does not appear in your list anywhere, at least I could not find it. We really need to be able to report on this, as we've been having problems with grid replication getting overloaded by DDNS updates and we need to be able to keep tabs on it. It is possible to monitor this today with SNMP (Infoblox Platform One MIB / ibClusterReplicationStatusTable/ibNodeQueueFromMaster & ibNodeQueueToMaster or .1.3.6.1.4.1.7779.3.1.1.2.1.2.1.5)

How can we go about getting this added to the reporter indexes?

Thanks for all your help!