Splunk Search

How do I see what fields are in indexed metadata?


I know some fields like _time, host, sourcetype, and source are in indexed metadata but what query do I need to list all fields in indexed metadata for a specified index?

My intent is to do a tstats query later on if the field I'm looking for is available.

Note: I don't have access to the backend.

0 Karma


Hi russell120,
fields extraction is defined by sourcetype not by index, this means that you could have different fields on different logs in the same index.

Don't think to an index as a DB table: an index is a silos where should be stored data with common retention period and common access rights, in addition (if you like) you could also differentiate indexes also for kind of data and there are some best practice to do this (e.g. don't put in the same index data with a large flow with data with a little flow) but it isn't mandatory.

Instead it could be important to know all the fields available for a sourcetype because this is the driver: to do this you can run a simple search in Verbose Mode ( index=my_index ) and see the extracted fields in the left side of you screen.


0 Karma


Hi Giuseppe,
Sorry, I might not have been clear enough. I just want to know what query I need to show the fields that are in the indexed metadata (the index-time fields), not the regular index (search-time fields).

I want to run a search similar to the below but I cannot because I don't know which index-time fields are even available to put inside the argument for values(). I want a fast way to list all the ips in this index (doing it the normal way is too slow in my current environment):

| tstats values(netbiosName)  where index=exampleIndex by ip
0 Karma
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! 👏 Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...