Splunk Search
Highlighted

How do I search for and return extracted fields list in a table?

Splunk Employee
Splunk Employee

In other words, I want to first search on some events, and then I would like to create a table and include a column in that table containing the list of the extracted Field names.

Has anyone done this already or know what the Fields metadata name is to build this type of field of Fields, if you will?

Highlighted

Re: How do I search for and return extracted fields list in a table?

Builder

I am not familiar with a way to do this out-of-the box, so here's a search command for this...listfields will return a single column named "field" with each field found in the search as a result row. Example search would be: "* | head 10 | listfields | search field=foo".

## commands.conf
[listfields]
filename = listfields.py
retainsevents = false
streaming = false
supports_multivalues = true

## listfields.py
import os
import re
import sys
import splunk.Intersplunk

if __name__ == '__main__':

    try:

        results = splunk.Intersplunk.readResults(None, None, True)
        fields = []

        if len(results) > 0:
          for k,v in results[0].items():
            field = {}
            field['field'] = k
            fields.append(field)

        results = fields

    except Exception, e:
        results = splunk.Intersplunk.generateErrorResults(str(e))

    splunk.Intersplunk.outputResults(results)
Highlighted

Re: How do I search for and return extracted fields list in a table?

Splunk Employee
Splunk Employee

Simple:

... | transpose | fields column
Highlighted

Re: How do I search for and return extracted fields list in a table?

Builder

Much simpler!

0 Karma