I know this is an old thread but I came up with this. Its shows the datamodel name, the index and sourcetype that feeds that datamodel, and what fields are in that datamodel. | datamodel | rex field=_raw "\"modelName\"\s*\:\s*\"(?<modelName>[^\"]+)\"" | spath output=fieldList objects{}.fields{}.displayName | table modelName fieldList | where modelName!="Splunk_CIM_Validation" | table modelName fieldList | map maxsearches=40 search="tstats `summariesonly` count from datamodel=$modelName$ by sourcetype,index | eval modelName=\"$modelName$\" | eval fieldList=\"$fieldList$\"" | stats values(fieldList) as fieldList values(index) as index, values(sourcetype) as sourcetype by modelName ... View more