As per nick's answer to this question: http://splunk-base.splunk.com/answers/4437/generate-list-of-all-fields-in-a-search
<your search> | stats dc(*) as *
Or with everything row-by-row,
<your search> | stats dc(*) as * | transpose | table column
Here's something I cobbled together based on several answers:
index=*
|eval index_sourcetype=index+"-"+sourcetype
|chart limit=0 count(*) as * by index_sourcetype
|untable index_sourcetype field value
|xyseries field index_sourcetype value
Since the original answer in 2011, we now have the fieldsummary
command, so you can list the fields from a search:
yoursearchhere | fieldsummary
This command provides a lot more info than just the field names, though. So you might want to do this
yoursearchhere | fieldsummary | fields field
I like this solution. Very nice.
As per nick's answer to this question: http://splunk-base.splunk.com/answers/4437/generate-list-of-all-fields-in-a-search
<your search> | stats dc(*) as *
Or with everything row-by-row,
<your search> | stats dc(*) as * | transpose | table column