topic Which command is used to take away a field from the results display? in Splunk Search

Which command is used to take away a field from the results display?

splunkerkanaka — Sun, 06 Aug 2017 17:59:50 GMT

Is there a specific command that we use to take away a field from the results displayed?

Re: Which command is used to take away a field from the results display?

niketn — Sun, 06 Aug 2017 18:40:51 GMT

@splunkerkanaka, it should be | fields - <YourFieldToBeRemoved>
Refer to documentation on fields command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Fields

Re: Which command is used to take away a field from the results display?

DalJeanis — Sun, 06 Aug 2017 18:50:50 GMT

There are two ways to do that, and they have different effects -

** FIELDS **

| fields - myfield
| fields + keepfield1 keepfield2 ... keepfieldX

The fields command is a distributable, streaming command. The first one removes myfield, the second one removes all fields except the listed ones, but also leaves the internal fields like _time. There is no limit on the number of records that can pass through the fields command.

** TABLE **

| table keepfield1 keepfield2 ... keepfieldX

The table command is NOT a streaming command, it is a transforming command. It keeps only the listed fields, deleting all internal fields that aren't listed, and formats the result as a table. WARNING - Table has a limit to the number of results it puts out.