topic Re: How to restrict search results to columns wanted in Splunk Search

How to restrict search results to columns wanted

jtpryan — Wed, 30 Sep 2020 03:05:20 GMT

I have a search that returns a large amount of information in each row, resulting in many columns, most of which I don't want in this dashboard.

How do I restrict it to the columns I want?

For example: User, Stack_Name, Functional_Area, Squad.

Re: How to restrict search results to columns wanted

gcusello — Mon, 18 Nov 2019 15:03:56 GMT

Hi @jtpryan
did you explored the table command?

So, please, try something like this:

my_search
| table User Stack_Name Functional_Area Squad

For more infos see at https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Table

Ciao.
Giuseppe

Re: How to restrict search results to columns wanted

dindu — Wed, 30 Sep 2020 03:05:22 GMT

Hi Jtpryan,

You could use either "table" command or "fields" commands to include or exclude fields.

1)Table command
This is a transforming command and will include only the fields which are mentioned in the command.

Only User, Stack_Name, Functional_Area, Squad will get displayed as per below example.

|your_search
|table User, Stack_Name, Functional_Area, Squad

2)Fields command
This is used to either include or exclude any fields.Also displays the internal fields - with underscores like _time,useful to plot
charts in some cases.Uses + and - symbols to specify inclusion or exclusion.

Only User, Stack_Name, Functional_Area, Squad will get displayed and the internals fields are available to use.

|your_search
|fields + User, Stack_Name, Functional_Area, Squad

All fields EXCEPT User, Stack_Name, Functional_Area, Squad will get displayed

|your_search
|fields - User, Stack_Name, Functional_Area, Squad.

Happy Splunking!!

Re: How to restrict search results to columns wanted

jtpryan — Mon, 18 Nov 2019 15:54:42 GMT

Great Info. I tried table and it looks like it is exactly what I want. However, while it returns the columns I need, there is no data in them. The data is in the "events" visualizations, so I know it exists. Is it because those fields are under "metadata"?

Re: How to restrict search results to columns wanted

dindu — Wed, 30 Sep 2020 03:05:25 GMT

Hi JtPryan,

Great!!
Looks likes your source data is in JSON format.
Could you please try parsing the data.You could use "spath " command as below.

|index="" sourcetype=""
|spath input =_raw
|your_search
|table User, Stack_Name, Functional_Area, Squad

Re: How to restrict search results to columns wanted

to4kawa — Mon, 18 Nov 2019 17:22:16 GMT

| makeresults
| eval _raw="{ \"build_number\": 546,
\"build_url\": \"blar\",
\"event_tab\": \"build_report\",
\"job_name\": \"blar\",
\"job_result\": \"SUCCESS\",
\"metadata\": {
\"FUNCTOONAL_AREA\": \"DevOps\",
\"JMX_FILE\": \"Sample-Test-Plan/sendMessageTest\",
\"REQUIRED_LGS\": 1,
\"SQUAD_NAME\": \"SquadNameChong\",
\"STACK_NAME\": \"DevOps-jmeter\",
\"TEST_REPO_BRANCH\": \"feature/EFORTS\",
\"scm\": \"git\" },
\"page_num\": 1,
\"testsuite\": { },
\"user\": \"blar\" }"
| spath
| table metadata* user

Hi, The field name under metadata is
metadata. fieldname

Re: How to restrict search results to columns wanted

jtpryan — Mon, 18 Nov 2019 20:14:32 GMT

Sweet! Thank you. Now I need to figure out how to format my dashboard to just have the title of the column not be "metadata.x"
where x = the metadata subcategory.

Re: How to restrict search results to columns wanted

dindu — Wed, 30 Sep 2020 03:05:56 GMT

Hi jtpryan,
You could use rename command to change display name.

|index="" sourcetype=""
|spath input =_raw
|your_search
|table User, metadata.Stack_Name, metadata.Functional_Area, metadata.Squad
|rename metadata.Stack_Name as Stack_Name,metadata.Functional_Area as Functional_Area, metadata.Squad as Squad.

Please accept and upvote answers if it solved your issue.

Happy Splunking!!