We are trying to create a query to get list of fields in all sourcetypes grouped by sourcetype and index.
We tried to use following query but it's performance is very slow.
| tstats count WHERE index IN(main,_introspection) GROUPBY index, sourcetype
| rename index AS indexname, sourcetype AS sourcetypename
| map maxsearches=100 search="| search index=\"$indexname$\" sourcetype=\"$sourcetypename$\" | head 1|fieldsummary | eval index=\"$indexname$\", sourcetype=\"$sourcetypename$\" | WHERE NOT isnull(mean) | fields index, sourcetype, field"
Since there can be any number of sourcetypes(350+ for index=main), maxsearches cannot be set to such a high number.
Is there any way to optimize this query to increase performance or any other query that will do the job without any performance lag?
