My question is whether or not I can, via sp, return a list of all fieldnames which contain a specified value.
For instance, if I was looking for "superstar", can I construct a search which will return all fields which contain "superstar" as a value?
Sure. With splunkd being our superstar, you can do this:
index=_internal | fields - tag::*
| foreach * [eval fieldnames = if(<<FIELD>>=="splunkd", mvappend(fieldnames, "<<FIELD>>"), fieldnames)]
| stats values(fieldnames)
For me that yields series (from metrics logs) and sourcetype (obvious).