Knowledge Management

Compare Fields in Data Model vs all other Available fields

admins123
New Member

Hello I'm new to Splunk and I've encountered an issue trying to figure out how to create a search query that will allow me to compare all the fields in a datamodel vs all other fields. Example :I have a datamodel named MyDataModel. This datamodel includes the fields _value, time, _key, location. I would like to create a search that allows me to see all the fields in that particular data model (fields, _value, _key, location) vs all the fields in a specific data set (index=logix_logs) to see if there are any matches. The goal is to see if there are any fields in the datamodel that do not exist in the index=logix_logs data set so that they can be created if need be. Hope that helps. but I'm unsure how to complete the query to give me the information I need. Any help will be greatly appreciated!

Search that brings out all fields in a datamodel:
|datamodel
|spath output=modelName path=modelName
|spath output=foo path=objects{}
|mvexpand foo
|spath input=foo output=objectName path=objectName
|spath input=foo output=foo path=fields{}
|mvexpand foo
|spath input=foo output=fieldName path=fieldName
|spath input=foo output=type path=type
|table modelName,objectName,fieldName,type |search objectName="My DataModel"

Tags (1)
0 Karma

manish_singh_77
Builder

Which fields are you trying to compare? Could you please elaborate?

0 Karma

admins123
New Member

I'm sorry if my question is not very descriptive. Let me attempt to elaborate. I have a datamodel named MyDataModel. This datamodel includes the fields _value, time, _key, location. I would like to create a search that allows me to see all the fields in that particular data model (fields, _value, _key, location) vs all the fields in a specific data set (index=logix_logs) to see if there are any matches. The goal is to see if there are any fields in the datamodel that do not exist in the index=log_logs data set so that they can be created if need be. Hope that helps.

0 Karma
Get Updates on the Splunk Community!

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...