list_sourcetypes
Retrieve all available sourcetypes from your Splunk instance to understand data formats, configure parsing rules, and optimize searches for data modeling and analysis.
Instructions
Discover and enumerate all available sourcetypes from the configured Splunk instance using the metadata command. Sourcetypes define how Splunk interprets and processes different types of data, controlling parsing rules, field extractions, and indexing behavior. This tool returns a comprehensive list of sourcetypes present in your Splunk environment, essential for data modeling and search optimization.
Use Cases:
Data modeling and CIM compliance
Understanding data variety and formats
Troubleshooting parsing and extraction issues
Planning data preprocessing and transformations
Security analysis and event correlation
Building comprehensive search queries
Response Format: Returns a dictionary with 'status' field and 'data' containing:
sourcetypes: Sorted array of all sourcetype identifiers
count: Total number of unique sourcetypes discovered
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||