If I do index=* | fieldsummary
I get the fieldsummary of all indices.
How can I add the index to the fieldsummary as an extra column, so that I will have:
index, field, count, distinct_count, ..., values
Try this (slower performance)
| eventcount summary=f index=* | table index
| map maxsearch=1000 search="search index=$index$ | fieldsummary | eval index=\"$index$\""
| table index *
OR
| rest /services/data/indexes | table title | dedup title
| map maxsearch=1000 search="search index=$title$ | fieldsummary | eval index=\"$title$\""
| table index *
Try this (slower performance)
| eventcount summary=f index=* | table index
| map maxsearch=1000 search="search index=$index$ | fieldsummary | eval index=\"$index$\""
| table index *
OR
| rest /services/data/indexes | table title | dedup title
| map maxsearch=1000 search="search index=$title$ | fieldsummary | eval index=\"$title$\""
| table index *