I was wondering if there is an easy way to create a table that contains every single recognized interesting field instead of doing the usual | table field1, field2...
method.
To be clear I want to have each row in the table as a separate instance/log and not a summary of counts. In other words, I would like a substitution for | table
but to capture every single interesting field that is recognized. Thanks!
I am sorry if I misunderstood the question.
In this search statement you can see the fields used in the log and the number of occurrences.
index=* | stats dc(*) as * | transpose
sorry this doesnt answer my question i am looking for a shortcut that will basically do something like this:
field1 . field2 .... field100
log A: stringA . stringB . stringC
logB: stringD . stringE . stringF
i know you can do it manually by performing the command | table field1, field2... field100
but typing out every field i want to capture is extremely time consuming so i am wondering if there is a shortcut to do it