Dear community,
I am using this community since years, so far I've found everything I needed. Now I am stuck!!!
I am trying the following:
I want to list all the index'es fields so when I build a query, to know immediately if a specific source has that field. Second part is easy. Once I have the list I know what I need to do. So, basically, I need something like this:
Fields
index1
index2
index3
indexn
field1
1
1
0
1
field2
0
0
1
1
fieldn
1
1
1
1
where 0 is when the field doesn't exist, 1 there is at least one value in the specific field.
My search looks like:
index IN
(
index 1
index2
indexn
)
| stats count(*) as * by index
| transpose column_name=Field header_field=index
|outputlookup whateverfile.csv
The problem with this search is that it takes ages, I don't need a full count. I just need to count the first value it gets and stop and then move on. In this way I will have a count of 0 if the field doesn't exist, 1 if exists.
Any ideas?
... View more