Hello Splunkers, This is my goal : A table with 3 column (field, field_type, field_len) and export it as CSV and CSV file name must be the sourcetype used in input (as a condition). field = list ...
See more...
Hello Splunkers, This is my goal : A table with 3 column (field, field_type, field_len) and export it as CSV and CSV file name must be the sourcetype used in input (as a condition). field = list all field for the sourcetype field_type = string, bool, int, etc. field_len = field length The issue is that I must launch the search for each sourcetype in my indexes (that's a lot). My CSV file is that form (it lists all sourcetype I use) : Sourcetype
sourcetype1
sourcetype2
sourcetype3
...
sourcetypeN My query is actually like : index=* sourcetype=MY_SOURCETYPE
| fieldsummary
| eval field_type=typeof(field), field_len=len(field)
| table field, field_type, field_len
| dedup field I want to add the multiple export to CSV and use a CSV in input instead of sourcetype="MY_SOURCETYPE" It could be like : index=main sourcetype=$sourcetype_from_csv_file$
| fieldsummary
| eval field_type=typeof(field), field_lgth=len(field)
| table field, field_type, field_lgth
| depup field
| outputcsv $sourcetype_from_csv_file$.csv How can I build this request as I don't know how to export in search / how to use a csv as input ?