Is there a way to search and list all attributes from a data model?

[spammenot66]

Is there a way to search and list all attributes from a data model in a search? For example if my data model consists of three attributes (host, uri_stem,referrer), is there a way to search the data model and list these three attributes into a search? Ideally, I would like to list these attributes and dynamically display values into a drop-down.

[sundareshr · Accepted solution]

Try this

| datamodel mydatamodel | spath | rename "objects{}.fields{}.displayName" AS fields | table fields | mvexpand fields

[xoriantkbisht]

Hi Sundareshr,
When i am running this query, it is not listing the auto extracted fields which i have added. But if i am using pivot, it is showing results in pivot for my added fields. Can you tell me what actions should i take for this ? so that these fields will get added and i can run search query for those 2 fields

[spammenot66]

you rule! this |datamodel command worked wonders for me.

[jkat54]

Or this one 😉

[jkat54]

The command you're looking for is called pivot:

http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Pivot

It's a little difficult to get used to so I recommend reading the documentation but here's a search using an out of the box datamodel

| pivot internal_audit_logs Audit count(Audit) AS "Count of Audit"

And here is another example with split rows (to list the values of each):

| pivot internal_server server count(server) AS "count(server)" SPLITROW host AS host SPLITROW source AS source SPLITROW sourcetype AS sourcetype