List all fields for an index

A few different queries / methods to list all fields for indexes.

index=yourindex| fieldsummary | table field

or

index=yourindex | stats values(*) AS * | transpose | table column | rename column AS Fieldnames

or

index=yourindex | stats dc() as * | transpose

or ;-)

index=yourindex | table *
Share This:
Tagged:

Comments

    1. splunk-pony

      It may just be on my instance but when using the fieldsummary command, the distinct count of values returned truncates to 500. There may be a limit configuration adjustment somewhere that would accommodate this.

      Reply

Leave A Comment?