SPL
List all fields for an index
Description
A few different queries / methods to list all fields for indexes.
9 0
index=yourindex| fieldsummary | table fieldor
index=yourindex | stats values(*) AS * | transpose | table column | rename column AS Fieldnamesor
index=yourindex | stats dc() as * | transposeor ;-)
index=yourindex | table *
Comments
2 total
index=your_index\r\n| fieldsummary\r\n| fields field values
It may just be on my instance but when using the fieldsummary command, the distinct count of values returned truncates to 500. There may be a limit configuration adjustment somewhere that would accommodate this.
Leave a comment
You must log in to post a comment.