metadata
This documentation applies to the following versions of Splunk: 4.0 , 4.0.1 , 4.0.2 , 4.0.3 , 4.0.4 , 4.0.5 , 4.0.6 , 4.0.7 , 4.0.8 , 4.0.9 , 4.0.10
metadata
Synopsis
Returns a list of source, sourcetypes, or hosts.
Syntax
metadata [type=<metadata-type>] [<index-specifier>]
Arguments
- type
- Syntax: type= hosts | sources | sourcetypes
- Description: Specify the type of metadata to return.
- index-specifier
- Syntax: index=<index_name>
- Description: Specify the index from which to return results.
Description
This search command generates a list of sources, sourcetypes, or hosts from the index; order controls how the results will be ordered, and start controls the offset from which results will be returned.
Examples
Example 1: Return the values of "host" for events in the "_internal" index.
| metadata type=hosts index=_internal