Splunk Search

index field list

cyberpop
New Member

I have a index, I want to know all display fields list and field description for this index without running the search,  where in splunk enterprise security, can we find this info?

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @cyberpop,

Splunk isn't a DB, so there isn't a list of fields related to an index, in other words, an index isn't a table!

So in Splunk fields extraction is ususally related to sourcetype, so you could try to see in [Settings -- Sourcetypes] if there is the list of the fields extractions, but it could be not sufficient, because if in your logs, theres something like "field=value", there's no field extraction and Splunk automatically recognize a field.

In conclusion, the only way to have the field list is to run a search like this:

index=your_index
| table *
| transpose
| table column

Ciao.

Giuseppe

0 Karma

FrankVl
Ultra Champion

In addition to @gcusello  his comment, you can also use the '| fieldsummary' command to get a summary of all fields extracted from the events in a certain index.

index=your_index | fieldsummary

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...