topic Re: list of all indexes and all fields within each index in Splunk Search

How to list of all indexes and all fields within each index?

TonyJobling — Thu, 06 Jul 2023 13:36:50 GMT

I can obtain a list of fields within an index eg.
index=bind_queries | stats values(*) AS * | transpose | table column | rename column AS Fieldnames

and a list of all indexes,
| eventcount summarize=false index=* index=_* | dedup index

But I'm struggling to successfully join the two.

Anyone know of a solution?

Re: list of all indexes and all fields within each index

somesoni2 — Wed, 03 Jan 2018 16:40:33 GMT

Give this a try (will be a painfully slow search, try to put small time range in the map subsearch)

| eventcount summarize=false index=* OR  index=_* | dedup index | map  maxsearches=1000 search="search index=$index$ earliest=-24h| fieldsummary maxvals=1 | eval index=\"$index$\" | table index field | rename field as Fieldnames "

Re: list of all indexes and all fields within each index

ajobling1964 — Wed, 03 Jan 2018 17:04:02 GMT

That seems to do the trick; I was not aware of the map command before. thanks.

Re: list of all indexes and all fields within each index

richgalloway — Wed, 03 Jan 2018 17:40:55 GMT

@ajobling, if your problem is resolved, please accept the answer to help future readers.

Re: list of all indexes and all fields within each index

sarit_s — Mon, 03 Jul 2023 08:53:32 GMT

Thanks
The problem is that it returns '1' in the current size column for all the indexes