I'd like to create a field whose value is a multi-value list of all field names in each respective event. I don't mind if it includes core fields like _time, or not.
example: field_list=host, source, sourcetype, _time, index, eventtype, punct, src_ip, dst_ip, etc.
This should do it, using _internal
to provide sample data:
index=_internal | head 5 | eval fields = "" | foreach * [eval fields = fields . if(isnotnull('<<FIELD>>'), "<<FIELD>>#", "")] | eval fields = rtrim(fields, "#") | makemv delim="#" fields
I've assumed that no field name is containing the #
sign - adjust the delimiter if that's not appropriate for your field names. Additionally I've assumed that there's no field called fields
.
This won't match fields starting with an underscore such as _time
, if you want to include those you can list them after the asterisk.
Requires Splunk 6.
can you share some raw events from your logs?