Splunk Search

How to create a search that lists all fields? (and data validation question)

mbasharat
Contributor

Hi,
I am looking to create a search that allows me to get a list of all fields in addition to below:

| tstats count WHERE index=ABC by index, source, sourcetype, _time
| fieldformat "_time"=strftime('_time', "%m/%d/%Y %T")
 | sort by _time Desc

How can I add field name in addition to results below in above SPL and get counts? I want to have an alternate version WITHOUT using tsats as well. So need both versions, with and without tstats.

Either I am missing a tiny piece above or brain needs some rest at the moment 🙂 Thanks in-advance

0 Karma
1 Solution

niketn
Legend

@mbasharat you can try one of my older answers which lists two options that you can try

https://answers.splunk.com/answers/590143/how-to-dynamically-populate-field-names-in-dropdow.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@mbasharat you can try one of my older answers which lists two options that you can try

https://answers.splunk.com/answers/590143/how-to-dynamically-populate-field-names-in-dropdow.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Sukisen1981
Champion

are you looking for something like this?

| tstats count WHERE index="_audit" by index, source, sourcetype, _time
| fieldformat "_time"=strftime('_time', "%m/%d/%Y %T")
| sort by _time Desc 
    | appendcols 
    [search index="_audit"
    | table *]

NOTE - the default _audit index has been considered here so that you can run the code as is

0 Karma

mbasharat
Contributor

Is there a field name that I can use below so my results include the field names as well and then respective counts?

| tstats count WHERE index=ABC by index, source, sourcetype, fieldname (like * or something that gives me list of fields as well), _time
| fieldformat "_time"=strftime('_time', "%m/%d/%Y %T")
| sort by _time Desc

In your provided query, appendcols are providing results. But I want the field names in the header to be in the column with respective event counts

0 Karma

Sukisen1981
Champion

hi @mbasharat - Can you give some example mock up based on the _audit index if possible?
I am not able to understand your desired output

0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...