stats values(*) missing columns / truncated columns (fie

[aa70627]

I'm trying to get list of all fields in a index and oddly enough there's missing fields through the two methods below. Is anyone else experiencing this issue?

Queries where i've confirmed im missing fields. FYI, i've included the where clause to exclude uninteresting fields and as many internal fields like (index, source, time, date, etc..)

1. index=myapp sourcetype=myapp | stats dc() as * | transpose| rename "row 1" as values | where values >1
2. index=myapp sourcetype=myapp | fieldsummary |fields field count distinct_count values| where distinct_count > 1

These two queries above are returning 77 fields for me, but when i run a query and include a table command with a manual entry list of all fields that i think are there, followed by either stats and or fieldsummary, then i get 88 fields. 

example of query returning more fields (in this case 87)

index=myapp sourcetype=myapp | fields f1 f2 f3 f4 f5.. f200 | fieldsummary |fields field  | where values >1

[ITWhisperer]

In your first 2 queries, you are removing fields where distinct count is 1, but you don't appear to be doing this in the last query. Would this not account for the "missing" fields?

[aa70627]

Initially posted this without the filter for distinct count and deleted because |stats values(*) as * would include internal fields that would inflate the number and make it look good so i deleted

I reposted after figuring that out found it was better to remove as much noise as possible.  bad typo on me this time around on my end