How do I see what fields are in indexed metadata?

[russell120]

I know some fields like _time, host, sourcetype, and source are in indexed metadata but what query do I need to list all fields in indexed metadata for a specified index?

My intent is to do a tstats query later on if the field I'm looking for is available.

Note: I don't have access to the backend.

[gcusello]

Hi russell120,
fields extraction is defined by sourcetype not by index, this means that you could have different fields on different logs in the same index.

Don't think to an index as a DB table: an index is a silos where should be stored data with common retention period and common access rights, in addition (if you like) you could also differentiate indexes also for kind of data and there are some best practice to do this (e.g. don't put in the same index data with a large flow with data with a little flow) but it isn't mandatory.

Instead it could be important to know all the fields available for a sourcetype because this is the driver: to do this you can run a simple search in Verbose Mode ( index=my_index ) and see the extracted fields in the left side of you screen.

Bye.
Giuseppe

[russell120]

Hi Giuseppe,
Sorry, I might not have been clear enough. I just want to know what query I need to show the fields that are in the indexed metadata (the index-time fields), not the regular index (search-time fields).

I want to run a search similar to the below but I cannot because I don't know which index-time fields are even available to put inside the argument for values(). I want a fast way to list all the ips in this index (doing it the normal way is too slow in my current environment):

| tstats values(netbiosName)  where index=exampleIndex by ip

[tiagofbmm]

Whoever decided that field X is supposed to be INDEXED into metadata, should have done the last step which is setting up fields.conf in the Search Head where the field is supposed to be searched for.

So you can do a rest call to that fields.conf and see what has been defined there: 

https://docs.splunk.com/Documentation/Splunk/9.0.4/Data/Configureindex-timefieldextraction#Add_an_en...

| rest /services/configs/conf-fields | where INDEXED=1 | table title

You can then relate the field name with props.conf and transforms by issuing similar calls