How to Map fields to sourcetype

[DanAlexander]

Hi All,

I need help building a SPL that would return all available fields mapped to their sourcetypes/source 

Looking across all Indexers crawling through all indexes index=*

I currently use to strip off all the fields and their extracted fields but I have no idea where they are coming from, what is their sourcetype and source:

index=*

fieldsummary

| search values!="[]"

| rex field=values max_match=0 "\{\"value\":\"(?<extracted_values>[^\"]+)\""

| fields field extracted_values

Thank you!

[yuanliu]

Do you mean something like

index=*
| stats values(*) as * by sourcetype
| foreach *
    [eval fields = mvappend(fields, if("<<FIELD>>" != "sourcetype", "<<FIELD>>", null()))]
| stats values(fields) as fields by sourcetype