get_metadata
Retrieve distinct metadata values for Splunk indexes to discover available hosts, sourcetypes, or sources within a specified time window, aiding targeted query construction and data validation.
Instructions
Retrieve distinct metadata values for a given index to aid query construction. Use this tool when you need to discover which hosts, sourcetypes, or sources are present in an index within a recent time window. This is useful for building targeted searches or validating data availability. Results are constrained by your Splunk permissions.
Args: index (str): Target index to inspect (e.g., 'main', 'security') field (str, optional): Metadata field to list values for. One of 'host', 'sourcetype', or 'source' (default: 'host') earliest_time (str, optional): Search start time (e.g., '-24h@h') (default: '-24h@h') latest_time (str, optional): Search end time (e.g., 'now') (default: 'now') limit (int, optional): Maximum number of distinct values to return (default: 100)
Response Format: Returns a dictionary with 'status' and 'data' containing:
field: Requested field name
index: Target index
values: Array of distinct values (up to 'limit')
count: Number of values returned
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| index | Yes | ||
| field | No | host | |
| earliest_time | No | -24h@h | |
| latest_time | No | now | |
| limit | No |