https://community.splunk.com/t5/Splunk-Dev/Can-I-select-specified-fields-with-the-Python-SDK/m-p/242226#M3070 <P>It's ... | fields - thisOne thatOne</P> <P>minus removes... plus adds / technically works too if you need to add a blank field, or if you just want to be verbose</P> <P>... | fields + Action bug_id Host User <BR /> is same as <BR /> ... | fields Action bug_id Host User </P> Tue, 29 Sep 2020 10:42:44 GMT jkat54 2020-09-29T10:42:44Z https://community.splunk.com/t5/Splunk-Dev/Can-I-select-specified-fields-with-the-Python-SDK/m-p/242223#M3067 <P>I'd like to write a python script to select only certain fields such as the UI does (example below) and load them into a pandas dataframe.</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/1750i845BEDF875FE1795/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Mon, 22 Aug 2016 14:57:11 GMT https://community.splunk.com/t5/Splunk-Dev/Can-I-select-specified-fields-with-the-Python-SDK/m-p/242223#M3067 anshanno 2016-08-22T14:57:11Z https://community.splunk.com/t5/Splunk-Dev/Can-I-select-specified-fields-with-the-Python-SDK/m-p/242224#M3068 <P>Yes, just use the fields command in your search string:</P> <PRE><CODE>...|fields Action bug_id Host User </CODE></PRE> Mon, 22 Aug 2016 15:12:04 GMT https://community.splunk.com/t5/Splunk-Dev/Can-I-select-specified-fields-with-the-Python-SDK/m-p/242224#M3068 jkat54 2016-08-22T15:12:04Z https://community.splunk.com/t5/Splunk-Dev/Can-I-select-specified-fields-with-the-Python-SDK/m-p/242225#M3069 <P>Awesome, thank you so much! I wasn't able to find this in the documentation.</P> <P>EDIT: is there away to get rid of the extra garbage too, I am presuming something like ...|exclude fields yada yada?</P> <P>Action,User,"b_Project",Host,"_bkt","_cd","_indextime","_kv","_raw","_serial","_si","_sourcetype","_subsecond","_time"</P> Tue, 29 Sep 2020 10:42:41 GMT https://community.splunk.com/t5/Splunk-Dev/Can-I-select-specified-fields-with-the-Python-SDK/m-p/242225#M3069 anshanno 2020-09-29T10:42:41Z https://community.splunk.com/t5/Splunk-Dev/Can-I-select-specified-fields-with-the-Python-SDK/m-p/242226#M3070 <P>It's ... | fields - thisOne thatOne</P> <P>minus removes... plus adds / technically works too if you need to add a blank field, or if you just want to be verbose</P> <P>... | fields + Action bug_id Host User <BR /> is same as <BR /> ... | fields Action bug_id Host User </P> Tue, 29 Sep 2020 10:42:44 GMT https://community.splunk.com/t5/Splunk-Dev/Can-I-select-specified-fields-with-the-Python-SDK/m-p/242226#M3070 jkat54 2020-09-29T10:42:44Z