Splunk Search

Create a field whose value is a multi-value list of all field names in each respective event

landen99
Motivator

I'd like to create a field whose value is a multi-value list of all field names in each respective event. I don't mind if it includes core fields like _time, or not.

example: field_list=host, source, sourcetype, _time, index, eventtype, punct, src_ip, dst_ip, etc.

Tags (3)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

This should do it, using _internal to provide sample data:

index=_internal | head 5 | eval fields = "" | foreach * [eval fields = fields . if(isnotnull('<<FIELD>>'), "<<FIELD>>#", "")] | eval fields = rtrim(fields, "#") | makemv delim="#" fields

I've assumed that no field name is containing the # sign - adjust the delimiter if that's not appropriate for your field names. Additionally I've assumed that there's no field called fields.
This won't match fields starting with an underscore such as _time, if you want to include those you can list them after the asterisk.
Requires Splunk 6.

0 Karma

somesoni2
Revered Legend

can you share some raw events from your logs?

0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...