Description

The metadata command returns a list of sources, sourcetypes, or hosts from a specified index or distributed search peer. The command searches the metadata inside the buckets for the specified index and time frame. It is primarily used for administrative purposes to retrieve information about the data stored in Splunk, such as identifying all available sources, sourcetypes, or hosts within a given index.

1

| metadata type=sources index=main

Syntax

The syntax is pretty straightforward, if you are looking for hosts use type=hosts and specify the index you are trying to monitor. The same logic goes for type=sources or type=sourcetypes.

| metadata type=<sources|sourcetypes|hosts> index=<index>

The metadata command in Splunk is generally fast because it queries metadata directly from index buckets, avoiding the need to scan individual events. This makes it more efficient for retrieving lists of hosts, sources, or sourcetypes compared to running a command like tstats, which aggregates event counts across indexed data and may require more processing. Example.

1

| tstats count where index=windows by host

Use Cases

Monitoring Inactive Hosts

If you ever need to determine which hosts have stopped forwarding data to Splunk, this command makes identifying them very easy. If you have a single source of truth, such as a lookup of all enterprise assets in the environment, it’s also easy to track log outages for hosts in a particular index.

The following would allow you to identify any windows hosts that have stopped reporting.

1
2
3

| metadata type=hosts index=windows
| sort recentTime
| convert ctime(recentTime) as Latest_Time

Tracking Log Outages

To take this a step further, you can build a log outage tracker that identifies when a host goes inactive. This is a requirement in some environments, since a log outage can be an indicator of suspicious activity.

The following lists every Windows host that hasn’t sent data in the last 24 hours, along with how long it’s been quiet. Save it as a scheduled alert to get notified when a host drops off.

1
2
3
4
5
6

| metadata type=hosts index=windows
| where recentTime < relative_time(now(), "-24h")
| eval hours_silent=round((now() - recentTime) / 3600, 1)
| convert ctime(recentTime) as Latest_Time
| table host Latest_Time hours_silent
| sort - hours_silent