https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-How-to-get-a-field-break-down-for-a-Web/m-p/475472#M7452 <P>I know the field names @ChrisG, if this is what you meant, but I like to see a breakdown of the fields, since there are quite a bit of them.</P> Wed, 11 Sep 2019 15:23:55 GMT danielbb 2019-09-11T15:23:55Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-How-to-get-a-field-break-down-for-a-Web/m-p/475470#M7450 <P>I'm looking at the <EM>Web</EM> datamodel and try to determine which fields are populated. </P> <P>I can do :<BR /> <CODE>| tstats dc(sourcetype) FROM datamodel=Web by sourcetype</CODE> <BR /> and <CODE>| tstats count(sourcetype) <BR /> FROM datamodel=Web by sourcetype</CODE> or <BR /> <CODE>| tstats count(Web.status) FROM datamodel=Web by Web.status</CODE> </P> <P>but I like to see a breakdown of all the fields in this datamodel. </P> <P>Is it possible? </P> Wed, 11 Sep 2019 14:58:39 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-How-to-get-a-field-break-down-for-a-Web/m-p/475470#M7450 danielbb 2019-09-11T14:58:39Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-How-to-get-a-field-break-down-for-a-Web/m-p/475471#M7451 <P>You can refer to the Common Information Model documentation. See <A href="https://docs.splunk.com/Documentation/CIM/4.13.0/User/Web">https://docs.splunk.com/Documentation/CIM/4.13.0/User/Web</A>.</P> Wed, 11 Sep 2019 15:19:00 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-How-to-get-a-field-break-down-for-a-Web/m-p/475471#M7451 ChrisG 2019-09-11T15:19:00Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-How-to-get-a-field-break-down-for-a-Web/m-p/475472#M7452 <P>I know the field names @ChrisG, if this is what you meant, but I like to see a breakdown of the fields, since there are quite a bit of them.</P> Wed, 11 Sep 2019 15:23:55 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-How-to-get-a-field-break-down-for-a-Web/m-p/475472#M7452 danielbb 2019-09-11T15:23:55Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-How-to-get-a-field-break-down-for-a-Web/m-p/475473#M7453 <P>I guess I'm not sure what you mean by "breakdown." The doc lists the field names, data type, description, and example values. Can you clarify your question, to help the community answer better?</P> Wed, 11 Sep 2019 15:30:22 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-How-to-get-a-field-break-down-for-a-Web/m-p/475473#M7453 ChrisG 2019-09-11T15:30:22Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-How-to-get-a-field-break-down-for-a-Web/m-p/475474#M7454 <P>Sure, I would like to see which fields are populated with which values across all the fields which are available in this datamodel, without examining each field individually. I hope it's clear.</P> Wed, 11 Sep 2019 15:42:00 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-How-to-get-a-field-break-down-for-a-Web/m-p/475474#M7454 danielbb 2019-09-11T15:42:00Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-How-to-get-a-field-break-down-for-a-Web/m-p/475475#M7455 <P>I guess the pivot is a good place to explore the datamodel. </P> Thu, 12 Sep 2019 13:17:19 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-How-to-get-a-field-break-down-for-a-Web/m-p/475475#M7455 danielbb 2019-09-12T13:17:19Z