Splunk Search

How would I get stats on the fieldname (not value)?

Champion

I'm working with multiple logs which have different field naming conventions for the same date. Is there a way to list out fieldnames (by sourcetype) ?

Tags (3)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi the_wolverine

I'm pretty sure you can use this as a start and do some fancy stuff out of it:

  | stats dc(*) as * by sourcetype 

cheers,
MuS

View solution in original post

SplunkTrust
SplunkTrust

Hi the_wolverine

I'm pretty sure you can use this as a start and do some fancy stuff out of it:

  | stats dc(*) as * by sourcetype 

cheers,
MuS

View solution in original post