Splunk Search

How do I see what fields are in indexed metadata?

Communicator

I know some fields like _time, host, sourcetype, and source are in indexed metadata but what query do I need to list all fields in indexed metadata for a specified index?

My intent is to do a tstats query later on if the field I'm looking for is available.

Note: I don't have access to the backend.

0 Karma

SplunkTrust
SplunkTrust

Hi russell120,
fields extraction is defined by sourcetype not by index, this means that you could have different fields on different logs in the same index.

Don't think to an index as a DB table: an index is a silos where should be stored data with common retention period and common access rights, in addition (if you like) you could also differentiate indexes also for kind of data and there are some best practice to do this (e.g. don't put in the same index data with a large flow with data with a little flow) but it isn't mandatory.

Instead it could be important to know all the fields available for a sourcetype because this is the driver: to do this you can run a simple search in Verbose Mode ( index=my_index ) and see the extracted fields in the left side of you screen.

Bye.
Giuseppe

0 Karma

Communicator

Hi Giuseppe,
Sorry, I might not have been clear enough. I just want to know what query I need to show the fields that are in the indexed metadata (the index-time fields), not the regular index (search-time fields).

I want to run a search similar to the below but I cannot because I don't know which index-time fields are even available to put inside the argument for values(). I want a fast way to list all the ips in this index (doing it the normal way is too slow in my current environment):

| tstats values(netbiosName)  where index=exampleIndex by ip
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!