Recover all fields in a Splunk environment

[SplunkExplorer]

Hi Splunkers, I have the following tasks: I need to compare 2 different Splunk instances, that should be deployed in the same way, but should be not. So I have some sub tasks, to perform this checks.

One of them is this: in the first instances, some fields deployed by previous Splunk admin should be present (as you can imagine, if I'm here to ask for this, no documentation has been produced). Those field should have been replicated also on the second one, migrating some apps and addon on, but some of them could be in a missing state.

So, the idea is: avoiding the most obvious way, whic is GUI-> Settings -> Field, is there another way to ask to Splunk: "hey, could list me all field that are inside you"'? The idea is a search, or recover them from command line, to obtain 2 file and compare them, for example 2 different txt/csv files.

[PickleRick]

There are two different approaches to this.

One is to compare the result of searches. But this is limited to a given set of constraints (source, sourcetype, host) and since props and transforms can be defined based on each of those parameters, tracking them down to the real difference in config can be tricky (and doing a summarized field count over - for example - sourcetype might not show you difference in sources).

Another is to run btool and compare effective configs.

splunk btool props list --debug
splunk btool transforms list --debug
splunk btool fields list --debug

and so on

[isoutamo]

I propose the last option. But in 1st phase it could be easier to find differences without --debug option (this shows where those are defined). After you know those differences then look where those are defined.

[splunkreal]

Hi @SplunkExplorer you can try this :

<yoursearch> | stats dc(*) as *