Splunk Search

How do I see what fields are in indexed metadata?

russell120
Communicator

I know some fields like _time, host, sourcetype, and source are in indexed metadata but what query do I need to list all fields in indexed metadata for a specified index?

My intent is to do a tstats query later on if the field I'm looking for is available.

Note: I don't have access to the backend.

0 Karma

gcusello
Legend

Hi russell120,
fields extraction is defined by sourcetype not by index, this means that you could have different fields on different logs in the same index.

Don't think to an index as a DB table: an index is a silos where should be stored data with common retention period and common access rights, in addition (if you like) you could also differentiate indexes also for kind of data and there are some best practice to do this (e.g. don't put in the same index data with a large flow with data with a little flow) but it isn't mandatory.

Instead it could be important to know all the fields available for a sourcetype because this is the driver: to do this you can run a simple search in Verbose Mode ( index=my_index ) and see the extracted fields in the left side of you screen.

Bye.
Giuseppe

0 Karma

russell120
Communicator

Hi Giuseppe,
Sorry, I might not have been clear enough. I just want to know what query I need to show the fields that are in the indexed metadata (the index-time fields), not the regular index (search-time fields).

I want to run a search similar to the below but I cannot because I don't know which index-time fields are even available to put inside the argument for values(). I want a fast way to list all the ips in this index (doing it the normal way is too slow in my current environment):

| tstats values(netbiosName)  where index=exampleIndex by ip
0 Karma
Get Updates on the Splunk Community!

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...