To access the data inventory, navigate to the “Data Inventory” tab in the top screen menu.
The table displays a list of sourcetypes, what index they belong to, the number of events, license usage, and the retention period.
The top banner shows the Sourcetype Count, Index Count, and includes the option to create a new data request. To learn how to create a data request, click here.
Data Inventory contains several filtering features located beneath the top banner.
Users can filter the Data Inventory by Index and Sourcetype by selecting an option from the dropdown menus.
Users can also select a time range by clicking the “TIME RANGE” menu. The time range can be determined by preset ranges, relative time, real-time, a date range, a date and time range, or by using the advanced settings. All options are accessible by expanding their corresponding arrow (>) in the “TIME RANGE” dropdown menu.
Use the “SEARCH” bar to filter by type-search for certain data sources. The “X” button at the far right of the page clears all filters.
Clicking the arrow (>) next to the sourcetype expands the field to show metadata. From here, users can add details or edit the definition. To learn more about adding and editing data inventory definitions, click here.
