https://community.splunk.com/t5/Splunk-Search/How-to-list-fields-values-and-also-index-and-source-names-using/m-p/213165#M140462 <P>Is there a way to get difference in two searches using the above search?<BR /> Basically I am trying to see the difference in fields today from yesterday and I also want to display the source name and index. <BR /> I can easily find the difference but I can’t display the index name and source name with it. The above query seems to serve the purpose but I can’t figure out how to use this in my case. Any help appreciated.</P> Tue, 14 Apr 2020 01:02:41 GMT AishBhardwaj 2020-04-14T01:02:41Z https://community.splunk.com/t5/Splunk-Search/How-to-list-fields-values-and-also-index-and-source-names-using/m-p/213162#M140459 <P>Hi All,</P> <P>I need to look for specific fields in all my indexes. Using fieldsummary, I am able to get a listing of my specific fields, count, distinct_count and values, but I also like to add 2 new columns so it would also give the index and the source names.</P> <P>Is there a way to do this with fieldsummary or would there be an alternatively.</P> <P>Thanks.</P> Mon, 08 Jun 2020 15:41:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-list-fields-values-and-also-index-and-source-names-using/m-p/213162#M140459 chanmic 2020-06-08T15:41:58Z https://community.splunk.com/t5/Splunk-Search/How-to-list-fields-values-and-also-index-and-source-names-using/m-p/213163#M140460 <P>See if the following helps and run it against last 24 hours or less if possible (careful as it will be a bit slow):</P> <PRE><CODE>| tstats count WHERE index=* GROUPBY index, sourcetype | fields - count | rename index AS indexname, sourcetype AS sourcetypename | map maxsearches=5 search="| search index=\"$indexname$\" sourcetype=\"$sourcetypename$\" | head 100 | fieldsummary | eval index=\"$indexname$\", sourcetype=\"$sourcetypename$\" | fields index, sourcetype, *" </CODE></PRE> <P>You can play with the maxsearches value to match your needs once you have the final version as it can't be unlimited I'm afraid.<BR /> If you want the source instead of the sourcetype simply replace it in the query above.</P> Wed, 04 Jan 2017 09:14:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-list-fields-values-and-also-index-and-source-names-using/m-p/213163#M140460 javiergn 2017-01-04T09:14:02Z https://community.splunk.com/t5/Splunk-Search/How-to-list-fields-values-and-also-index-and-source-names-using/m-p/213164#M140461 <P>Thanks Javiergn</P> Fri, 06 Jan 2017 03:09:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-list-fields-values-and-also-index-and-source-names-using/m-p/213164#M140461 chanmic 2017-01-06T03:09:54Z https://community.splunk.com/t5/Splunk-Search/How-to-list-fields-values-and-also-index-and-source-names-using/m-p/213165#M140462 <P>Is there a way to get difference in two searches using the above search?<BR /> Basically I am trying to see the difference in fields today from yesterday and I also want to display the source name and index. <BR /> I can easily find the difference but I can’t display the index name and source name with it. The above query seems to serve the purpose but I can’t figure out how to use this in my case. Any help appreciated.</P> Tue, 14 Apr 2020 01:02:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-list-fields-values-and-also-index-and-source-names-using/m-p/213165#M140462 AishBhardwaj 2020-04-14T01:02:41Z https://community.splunk.com/t5/Splunk-Search/How-to-list-fields-values-and-also-index-and-source-names-using/m-p/213166#M140463 <P>please ask by another question and provide sample query.</P> Tue, 14 Apr 2020 01:12:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-list-fields-values-and-also-index-and-source-names-using/m-p/213166#M140463 to4kawa 2020-04-14T01:12:26Z