https://community.splunk.com/t5/Splunk-Dev/Query-many-fields-with-the-same-part-in-the-name/m-p/309553#M4127 <P>Be sure to click <CODE>Accept</CODE> to close the question.</P> Fri, 01 Sep 2017 22:40:29 GMT woodcock 2017-09-01T22:40:29Z https://community.splunk.com/t5/Splunk-Dev/Query-many-fields-with-the-same-part-in-the-name/m-p/309550#M4124 <P>Hi, </P> <P>i have events in one sourcetype with over 90 similar fields like field1, field2 ... field90.</P> <P>I can write a query like: search index=a sourcetype=2 field1=* field2=* ..field90=* | stats min(field1), max(field1, min(field2), max(field2)</P> <P>is there a way reduce the long query to something like: index=a sourcetype=2 field*=* | stats min(field*) max(field*) ? </P> <P>THX</P> Tue, 29 Sep 2020 15:33:48 GMT https://community.splunk.com/t5/Splunk-Dev/Query-many-fields-with-the-same-part-in-the-name/m-p/309550#M4124 amielke 2020-09-29T15:33:48Z https://community.splunk.com/t5/Splunk-Dev/Query-many-fields-with-the-same-part-in-the-name/m-p/309551#M4125 <P>If _raw has a field</P> <PRE><CODE>index=a sourcetype=2 "field*=*"|stats min(field*) as min_field* max(field*) as max_field* </CODE></PRE> <P>※You can use wild cards for stats.</P> Wed, 30 Aug 2017 06:29:47 GMT https://community.splunk.com/t5/Splunk-Dev/Query-many-fields-with-the-same-part-in-the-name/m-p/309551#M4125 HiroshiSatoh 2017-08-30T06:29:47Z https://community.splunk.com/t5/Splunk-Dev/Query-many-fields-with-the-same-part-in-the-name/m-p/309552#M4126 <P>index=a sourcetype=2 |stats min(field*) as min_field* max(field*) as max_field*</P> <P>Works fine, Thank you <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 29 Sep 2020 15:33:50 GMT https://community.splunk.com/t5/Splunk-Dev/Query-many-fields-with-the-same-part-in-the-name/m-p/309552#M4126 amielke 2020-09-29T15:33:50Z https://community.splunk.com/t5/Splunk-Dev/Query-many-fields-with-the-same-part-in-the-name/m-p/309553#M4127 <P>Be sure to click <CODE>Accept</CODE> to close the question.</P> Fri, 01 Sep 2017 22:40:29 GMT https://community.splunk.com/t5/Splunk-Dev/Query-many-fields-with-the-same-part-in-the-name/m-p/309553#M4127 woodcock 2017-09-01T22:40:29Z