search for all fields which have some string in field

0
votes

How can I get only results for specific fields where field name is like something ?

fx. get all fields which have "status" in their field name. I tried this but It doesnt work: sta* I want also to do later this: sta* OR STA* OR Sta*

2
splunksplunk-query
Hi there, please look at this guide how to ask good questions. Some formatting as Code might already be enough to make your question good enough. - Jan

2 Answers

0
votes

Entering just "status" in the search box may not be enough. It depends on what your default indexes are and where the data is. By default, the default index is 'main', but your admins may have put the data in different indexes. Using index=* status for a 15-minute search should tell you which index holds the data. Then you can specify it in your subsequent searches.

0
votes

The solution for this is using following:

 | fieldsummary  sta* STA* Sta*