Splunk Search

How do I see what fields are in indexed metadata?

russell120
Communicator

I know some fields like _time, host, sourcetype, and source are in indexed metadata but what query do I need to list all fields in indexed metadata for a specified index?

My intent is to do a tstats query later on if the field I'm looking for is available.

Note: I don't have access to the backend.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi russell120,
fields extraction is defined by sourcetype not by index, this means that you could have different fields on different logs in the same index.

Don't think to an index as a DB table: an index is a silos where should be stored data with common retention period and common access rights, in addition (if you like) you could also differentiate indexes also for kind of data and there are some best practice to do this (e.g. don't put in the same index data with a large flow with data with a little flow) but it isn't mandatory.

Instead it could be important to know all the fields available for a sourcetype because this is the driver: to do this you can run a simple search in Verbose Mode ( index=my_index ) and see the extracted fields in the left side of you screen.

Bye.
Giuseppe

0 Karma

russell120
Communicator

Hi Giuseppe,
Sorry, I might not have been clear enough. I just want to know what query I need to show the fields that are in the indexed metadata (the index-time fields), not the regular index (search-time fields).

I want to run a search similar to the below but I cannot because I don't know which index-time fields are even available to put inside the argument for values(). I want a fast way to list all the ips in this index (doing it the normal way is too slow in my current environment):

| tstats values(netbiosName)  where index=exampleIndex by ip
0 Karma

tiagofbmm
Influencer

Whoever decided that field X is supposed to be INDEXED into metadata, should have done the last step which is setting up fields.conf in the Search Head where the field is supposed to be searched for.

So you can do a rest call to that fields.conf and see what has been defined there: 

https://docs.splunk.com/Documentation/Splunk/9.0.4/Data/Configureindex-timefieldextraction#Add_an_en...

| rest /services/configs/conf-fields | where INDEXED=1 | table title

You can then relate the field name with props.conf and transforms by issuing similar calls

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...