data types

[rcbutterfield]

How can you query an index to find out the data types of the fields and any attributes that describe the field?  from a data governance perspective to document.  Apologies... new to this...  I know that you can query the index and fields would be listed and see some of the metadata type info but it's not exportable..i  would like to query and export that info.  thx

[rcbutterfield]

Thank you.... yes, that worked and will give me something to work with.   Much appreciated!

[livehybrid · Accepted solution]

Hi @rcbutterfield 

This might work for you - this works by taking the latest value of each field for each sourcetype in the initial query and then performing a "typeof" command to determine the type.

Update the first line accordingly:

index=_internal | head 100
| stats latest(*) AS * by sourcetype
| foreach * [|eval fieldInfo=mvappend(fieldInfo,"<<FIELD>>=".typeof(<<FIELD>>))]
| stats values(fieldInfo) by sourcetype

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing