How do you extract the key/field from a common value?

[proletariat99]

If I search for a generic term -- say, "John Doe" and I get thousands of results from dozens of sourcetypes, how can I return the field/key name where John Doe exists?

For instance, if a proxy calls it, "user" and another sourcetype calls it "User" and another finds "John Doe" in "URL" or "admin_name" etc etc..., how can I return the field names where this value exists at search time?

I have tried eval, extract, values and fieldsummary but with no luck (could be a syntax thing, I'm relatively new to SPL)

Thanks.

[proletariat99]

Heh. I was just about to pose the same question when I ran across my old question and literally thought, "Oh hey! That's the exact same problem I have!"

Oh. That was me. Duh.

[dmaislin_splunk]

You could build extracts for each type of sourcetype and all it USER. Each sourcetype would have a different field extraction, but they would all be called USER. Or, let them all extract as different field names and then use the ALIAS in Splunk to name them all the same thing.

[proletariat99]

Thanks for the response. I'm still learning how to extract kv pairs, but wouldn't this solution still require me to manually go through each sourcetype and enumerate which field contains my value (user)?

I have to do this hundreds of times in the coming months, with dozens of sourcetypes per search (note: This would be a non-issue if we had the CIM all dialed in, but we have many custom TAs that aren't perfect yet, and many weird sourcetypes.)

Any other suggestions for returning the field name from a particular value?