Splunk Search
Highlighted

How to display a list of fields for an index?

Builder

All,

Is it possble to display a list of fields for an index?

Something like this?
index=java | dedup fields | table fields

thanks,
-Daniel

0 Karma
Highlighted

Re: How to display a list of fields for an index?

SplunkTrust
SplunkTrust

Hi daniel333,

Yes, this is possible using stats - take a look at this run everywhere example:

 index=_internal | stats values(*) AS * | transpose | table column | rename column AS Fieldnames

This will create a list of all field names within index _internal. Adopted to your search this should do it:

index=java | stats values(*) AS * | transpose | table column | rename column AS Fieldnames

Hope this helps ...

cheers, MuS

View solution in original post

Highlighted

Re: How to display a list of fields for an index?

SplunkTrust
SplunkTrust

or use the fieldsummary command in your search:

 index=java | fieldsummary | table field
0 Karma
Highlighted

Re: How to display a list of fields for an index?

Explorer

Youre looking for |fieldsummary|table field

Highlighted

Re: How to display a list of fields for an index?

SplunkTrust
SplunkTrust

Try:

index=java | stats dc() as * | transpose

Make sure there are some time restrictions applied.

Alternatively take a look at this: http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/Fieldsummary

0 Karma
Highlighted

Re: How to display a list of fields for an index?

Explorer

Simple ..!

index=java |table *

Then you can filter whatever fields you don't want.

0 Karma
Highlighted

Re: How to display a list of fields for an index?

Explorer

The search as noted above:
index=java | stats values(*) AS * | transpose | table column | rename column AS Fieldnames

works, but is there a way to calculate the event coverage as well? fieldsummary doesn't seem to show this

0 Karma