A user wants to see a list of all sourcetypes in the index "main". Which search command should be used?
This groups by sourcetype and shows each unique sourcetype present.
Why this answer
The `stats count by sourcetype` command groups events by sourcetype and returns a table listing each unique sourcetype along with its event count, effectively showing all sourcetypes present in the index. This is the correct approach because it uses aggregation to enumerate distinct values of the sourcetype field across the entire result set.
Exam trap
Splunk often tests the distinction between commands that return raw field values versus commands that aggregate or summarize, so candidates mistakenly choose `fields` thinking it lists unique values when it actually preserves all events.
How to eliminate wrong answers
Option A is wrong because `fields sourcetype` only removes all fields except sourcetype from the search results, but it does not list unique sourcetypes — it retains every event with its sourcetype value, so duplicates remain and no distinct list is produced. Option B is wrong because `data` is not a valid Splunk search command; there is no `data` command in SPL, so this would generate a syntax error. Option D is wrong because `top sourcetype` returns the most frequent sourcetypes sorted by count, but it limits output to a default of 10 results and does not guarantee a complete list of all sourcetypes in the index.