ThemetadataSPL command in Splunk can be used to retrieve various types of metadata information indexed in Splunk. To list the differentsourcetypes(i.e., the categorization of the incoming data), the analyst should use the argument metadata type=sourcetypes.
metadata type=sourcetypes returns a list of all sourcetypes currently indexed, which is essential for understanding what kinds of data are available.
metadata type=hosts lists hosts sending data but does not categorize data types.
metadata type=cdn and metadata type=assets are not valid or standard types for this command in Splunk.
This usage is documented in Splunk’s official search command reference and is fundamental for data management and onboarding processes.
[Reference:, Splunk Docs: metadata Command, Splunk Cybersecurity Defense Analyst Study Guide, Chapter 4: Data Inventory and Metadata Management, Splunk Enterprise Security User Guide, , , , ]
Submit