- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

datitran
New Member
01-25-2018
06:56 AM
If I do index=* | fieldsummary
I get the fieldsummary of all indices.
How can I add the index to the fieldsummary as an extra column, so that I will have:
index, field, count, distinct_count, ..., values
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

somesoni2
Revered Legend
01-25-2018
09:25 AM
Try this (slower performance)
| eventcount summary=f index=* | table index
| map maxsearch=1000 search="search index=$index$ | fieldsummary | eval index=\"$index$\""
| table index *
OR
| rest /services/data/indexes | table title | dedup title
| map maxsearch=1000 search="search index=$title$ | fieldsummary | eval index=\"$title$\""
| table index *
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

somesoni2
Revered Legend
01-25-2018
09:25 AM
Try this (slower performance)
| eventcount summary=f index=* | table index
| map maxsearch=1000 search="search index=$index$ | fieldsummary | eval index=\"$index$\""
| table index *
OR
| rest /services/data/indexes | table title | dedup title
| map maxsearch=1000 search="search index=$title$ | fieldsummary | eval index=\"$title$\""
| table index *
