topic how can i view a list of indexed fields? in Getting Data In

how can i view a list of indexed fields?

tpsplunk — Wed, 06 Jul 2011 16:16:42 GMT

I've added an index time field extraction which overlaps with a delimiter based search time extraction. i think i've got the settings right, but i can't use the fact that the field is available from the search app as proof that my field was extracted at index time. what tools can i use to verify that my field was indeed added to the index?

Re: how can i view a list of indexed fields?

jbsplunk — Thu, 07 Jul 2011 15:57:22 GMT

I don't think there is any way to view a list of all fields which splunk has indexed within the UI, at least AFAIK. What you can do is to look at the tags inside of the raw data in your hot/warm buckets. The file is called journal.gz. If you unpack it you can read the rawdata and see the indexed fields. Ideally, you should name the fields something slightly different, because as you've seen, this creates a data management headache. Just to reiterate, most of the time index time field extractions are not necessary.

Re: how can i view a list of indexed fields?

tpsplunk — Fri, 08 Jul 2011 22:05:21 GMT

how can i tell which are indexed fields in the journal.gz? it looks like all my fields show up (which could be the raw data i suppose). would it show up between the sourcetype and the "punct"?

Re: how can i view a list of indexed fields?

jbsplunk — Fri, 08 Jul 2011 22:26:37 GMT

where you see sourcetype and punct, those are fields which are indexed, so I would expect to see it in that section. Its probably easier just to rename the field to something else to ensure its showing up as the new name, vs digging through the journal. It isn't my idea of a good time anyway.

Re: how can i view a list of indexed fields?

tpsplunk — Fri, 08 Jul 2011 22:35:23 GMT

ok, perfect it is showing up there. thanks!

Re: how can i view a list of indexed fields?

a_kearney — Wed, 22 Jan 2020 13:03:17 GMT

A very old question, but I was wondering the same thing today and just came across the answer in conf talk by Martin Muller (https://conf.splunk.com/files/2019/summit/FN1003.mp4)

The command walklex (https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Walklex) can be used:

| walklex index="<index-name>" type=field
| search NOT field=" *"
| stats list(distinct_values) by field

Hope this is of use to people

Re: how can i view a list of indexed fields?

SUNDAY — Sat, 26 Sep 2020 00:32:43 GMT

It's 2020 now, and is the answer the same now?

Re: how can i view a list of indexed fields?

inventsekar — Sat, 26 Sep 2020 02:07:36 GMT

Yes @SUNDAY .. before your answer, Jan 2020 there was an answer as well.

that walklex should be working fine, as per my understanding.

https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Walklex

Re: how can i view a list of indexed fields?

landen99 — Tue, 06 Oct 2020 15:22:10 GMT

| rest splunk_server=local /servicesNS/nobody/search/configs/conf-fields | fields - TOKENIZER eai:acl.can_* eai:acl.mod* eai:acl.owner eai:acl.perms* eai:acl.remov* eai:acl.sharing* acl:appName id published updated | search disabled=0 | outputlookup fields_idx.csv

Re: how can i view a list of indexed fields?

marand — Wed, 30 Jun 2021 09:28:08 GMT

This should be marked as the new solution.