I need to collect list of sourcetypes for each forwarder using search query. i can get forwarders list from metics.log and sourcetype list from licence_usage log seperately from _internal index. Is there any way to get all the sourcetypes configured from each forwarder using single search query?
↧