I'm trying to get list of all fields in a index and oddly enough there's missing fields through the two methods below. Is anyone else experiencing this issue? Queries where i've confirmed im missing...
See more...
I'm trying to get list of all fields in a index and oddly enough there's missing fields through the two methods below. Is anyone else experiencing this issue? Queries where i've confirmed im missing fields. FYI, i've included the where clause to exclude uninteresting fields and as many internal fields like (index, source, time, date, etc..) index=myapp sourcetype=myapp | stats dc() as * | transpose| rename "row 1" as values | where values >1 index=myapp sourcetype=myapp | fieldsummary |fields field count distinct_count values| where distinct_count > 1 These two queries above are returning 77 fields for me, but when i run a query and include a table command with a manual entry list of all fields that i think are there, followed by either stats and or fieldsummary, then i get 88 fields. example of query returning more fields (in this case 87) index=myapp sourcetype=myapp | fields f1 f2 f3 f4 f5.. f200 | fieldsummary |fields field | where values >1