https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-that-lists-all-fields-and-data-validation/m-p/430381#M123072 <P>hi @mbasharat - Can you give some example mock up based on the _audit index if possible?<BR /> I am not able to understand your desired output</P> Thu, 20 Jun 2019 18:20:53 GMT Sukisen1981 2019-06-20T18:20:53Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-that-lists-all-fields-and-data-validation/m-p/430378#M123069 <P>Hi,<BR /> I am looking to create a search that allows me to get a list of all fields in addition to below:</P> <PRE><CODE>| tstats count WHERE index=ABC by index, source, sourcetype, _time | fieldformat "_time"=strftime('_time', "%m/%d/%Y %T") | sort by _time Desc </CODE></PRE> <P>How can I add field name in addition to results below in above SPL and get counts? I want to have an alternate version WITHOUT using tsats as well. So need both versions, with and without tstats.</P> <P>Either I am missing a tiny piece above or brain needs some rest at the moment <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> Thanks in-advance</P> Thu, 20 Jun 2019 16:30:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-that-lists-all-fields-and-data-validation/m-p/430378#M123069 mbasharat 2019-06-20T16:30:13Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-that-lists-all-fields-and-data-validation/m-p/430379#M123070 <P>are you looking for something like this?</P> <PRE><CODE>| tstats count WHERE index="_audit" by index, source, sourcetype, _time | fieldformat "_time"=strftime('_time', "%m/%d/%Y %T") | sort by _time Desc | appendcols [search index="_audit" | table *] </CODE></PRE> <P>NOTE - the default _audit index has been considered here so that you can run the code as is</P> Thu, 20 Jun 2019 17:28:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-that-lists-all-fields-and-data-validation/m-p/430379#M123070 Sukisen1981 2019-06-20T17:28:33Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-that-lists-all-fields-and-data-validation/m-p/430380#M123071 <P>Is there a field name that I can use below so my results include the field names as well and then respective counts?</P> <P>| tstats count WHERE index=ABC by index, source, sourcetype, fieldname (like * or something that gives me list of fields as well), _time<BR /> | fieldformat "_time"=strftime('_time', "%m/%d/%Y %T")<BR /> | sort by _time Desc</P> <P>In your provided query, appendcols are providing results. But I want the field names in the header to be in the column with respective event counts </P> Wed, 30 Sep 2020 00:59:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-that-lists-all-fields-and-data-validation/m-p/430380#M123071 mbasharat 2020-09-30T00:59:00Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-that-lists-all-fields-and-data-validation/m-p/430381#M123072 <P>hi @mbasharat - Can you give some example mock up based on the _audit index if possible?<BR /> I am not able to understand your desired output</P> Thu, 20 Jun 2019 18:20:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-that-lists-all-fields-and-data-validation/m-p/430381#M123072 Sukisen1981 2019-06-20T18:20:53Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-that-lists-all-fields-and-data-validation/m-p/430382#M123073 <P>@mbasharat you can try one of my older answers which lists two options that you can try </P> <P><A href="https://answers.splunk.com/answers/590143/how-to-dynamically-populate-field-names-in-dropdow.html">https://answers.splunk.com/answers/590143/how-to-dynamically-populate-field-names-in-dropdow.html</A></P> Sun, 23 Jun 2019 06:04:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-that-lists-all-fields-and-data-validation/m-p/430382#M123073 niketn 2019-06-23T06:04:08Z