Create a field whose value is a multi-value list of all field names in each respective event

[landen99]

I'd like to create a field whose value is a multi-value list of all field names in each respective event. I don't mind if it includes core fields like _time, or not.

example: field_list=host, source, sourcetype, _time, index, eventtype, punct, src_ip, dst_ip, etc.

[martin_mueller]

This should do it, using _internal to provide sample data:

index=_internal | head 5 | eval fields = "" | foreach * [eval fields = fields . if(isnotnull('<<FIELD>>'), "<<FIELD>>#", "")] | eval fields = rtrim(fields, "#") | makemv delim="#" fields

I've assumed that no field name is containing the # sign - adjust the delimiter if that's not appropriate for your field names. Additionally I've assumed that there's no field called fields.
This won't match fields starting with an underscore such as _time, if you want to include those you can list them after the asterisk.
Requires Splunk 6.

[somesoni2]

can you share some raw events from your logs?