Thanks for this. So taking these results, how would I join the index and sourcetype pair for each field name so I would end up with something like this: someIndex.someSourcetype.someFieldname
index=firewall sourcetype=firewall1
fieldnames: host, source, srcip, dest, etc etc.
firewall.firewall1.srcip
firewall.firewall1.dest
firewall.firewall1.destport
....
index=networkdevices sourcetype=ids1 (sourcetype=ids2...)
networkdevices.ids1.src
networkdevices.ids2.dest
...
networkdevices.router1.src
....
index=someApp sourcetype=someTCPsource
someApp.someTCPsource.src
someApp.someTCPsource.randomField1
.... Or, alternately, could I take the results of this query and run some modification of the search you proposed to dump the fieldname for each index:sourcetype pair? something like: | tstats values(field) as Field, count where index=* AND sourcetype=* by index, sourcetype
... View more
