I need only fields that are extracted during index_time which are added to _meta. How to search for them so that search is faster
Try something like this. This should give a list of metadata fields available for an index-sourcetype combination.
| metasearch index=YourIndex sourcetype=YourSourceType | head 1 | transpose
Hi ankithreddy777,
use | metasearch
before your search condition.
see http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Metasearch
Bye.
Giuseppe