Is there a way to search and list all attributes from a data model in a search? For example if my data model consists of three attributes (host, uri_stem,referrer), is there a way to search the data model and list these three attributes into a search? Ideally, I would like to list these attributes and dynamically display values into a drop-down.
When i am running this query, it is not listing the auto extracted fields which i have added. But if i am using pivot, it is showing results in pivot for my added fields. Can you tell me what actions should i take for this ? so that these fields will get added and i can run search query for those 2 fields
The command you're looking for is called pivot:
It's a little difficult to get used to so I recommend reading the documentation but here's a search using an out of the box datamodel
| pivot internalauditlogs Audit count(Audit) AS "Count of Audit"
And here is another example with split rows (to list the values of each):
| pivot internal_server server count(server) AS "count(server)" SPLITROW host AS host SPLITROW source AS source SPLITROW sourcetype AS sourcetype