Splunk Search

How to list of all indexes and all fields within each index?

TonyJobling
New Member

I can obtain a list of fields within an index eg.
index=bind_queries | stats values(*) AS * | transpose | table column | rename column AS Fieldnames

and a list of all indexes,
| eventcount summarize=false index=* index=_* | dedup index

But I'm struggling to successfully join the two.

Anyone know of a solution?

Labels (1)
Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try (will be a painfully slow search, try to put small time range in the map subsearch)

| eventcount summarize=false index=* OR  index=_* | dedup index | map  maxsearches=1000 search="search index=$index$ earliest=-24h| fieldsummary maxvals=1 | eval index=\"$index$\" | table index field | rename field as Fieldnames "

View solution in original post

somesoni2
Revered Legend

Give this a try (will be a painfully slow search, try to put small time range in the map subsearch)

| eventcount summarize=false index=* OR  index=_* | dedup index | map  maxsearches=1000 search="search index=$index$ earliest=-24h| fieldsummary maxvals=1 | eval index=\"$index$\" | table index field | rename field as Fieldnames "

sarit_s
Communicator

Thanks
The problem is that it returns '1' in the current size column for all the indexes

0 Karma

ajobling1964
New Member

That seems to do the trick; I was not aware of the map command before. thanks.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

@ajobling, if your problem is resolved, please accept the answer to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...