Splunk Search

How to list of all indexes and all fields within each index?

TonyJobling
New Member

I can obtain a list of fields within an index eg.
index=bind_queries | stats values(*) AS * | transpose | table column | rename column AS Fieldnames

and a list of all indexes,
| eventcount summarize=false index=* index=_* | dedup index

But I'm struggling to successfully join the two.

Anyone know of a solution?

Labels (1)
Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try (will be a painfully slow search, try to put small time range in the map subsearch)

| eventcount summarize=false index=* OR  index=_* | dedup index | map  maxsearches=1000 search="search index=$index$ earliest=-24h| fieldsummary maxvals=1 | eval index=\"$index$\" | table index field | rename field as Fieldnames "

View solution in original post

somesoni2
Revered Legend

Give this a try (will be a painfully slow search, try to put small time range in the map subsearch)

| eventcount summarize=false index=* OR  index=_* | dedup index | map  maxsearches=1000 search="search index=$index$ earliest=-24h| fieldsummary maxvals=1 | eval index=\"$index$\" | table index field | rename field as Fieldnames "

sarit_s
Communicator

Thanks
The problem is that it returns '1' in the current size column for all the indexes

0 Karma

ajobling1964
New Member

That seems to do the trick; I was not aware of the map command before. thanks.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

@ajobling, if your problem is resolved, please accept the answer to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...