Splunk Search

Retrieve names of all fields

Dark_Ichigo
Builder

Im trying to write a search where I can search for the names of the fields, so basically the search would return the name of the fields and only the names of all fields.

If this is possible, it would solve a lot of issues Im having, thanks!

1 Solution

Ayn
Legend

As per nick's answer to this question: http://splunk-base.splunk.com/answers/4437/generate-list-of-all-fields-in-a-search

<your search> | stats dc(*) as *

Or with everything row-by-row,

<your search> | stats dc(*) as * | transpose | table column

View solution in original post

AzJimbo
Path Finder

Here's something I cobbled together based on several answers:

index=*
|eval index_sourcetype=index+"-"+sourcetype 
|chart limit=0 count(*) as * by index_sourcetype
|untable index_sourcetype field value
|xyseries field index_sourcetype value

lguinn2
Legend

Since the original answer in 2011, we now have the fieldsummary command, so you can list the fields from a search:

yoursearchhere | fieldsummary

This command provides a lot more info than just the field names, though. So you might want to do this

yoursearchhere | fieldsummary | fields field

jzapantis
Path Finder

I like this solution. Very nice.

0 Karma

Ayn
Legend

As per nick's answer to this question: http://splunk-base.splunk.com/answers/4437/generate-list-of-all-fields-in-a-search

<your search> | stats dc(*) as *

Or with everything row-by-row,

<your search> | stats dc(*) as * | transpose | table column
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...