https://community.splunk.com/t5/Splunk-Search/How-to-filter-columns-in-a-search-query-splunk/m-p/362663#M165138 <P>or to add onto this, use the <CODE>fields field1 field2....</CODE> to show fields, instead of the <CODE>table</CODE> command</P> Wed, 15 Nov 2017 12:51:02 GMT cmerriman 2017-11-15T12:51:02Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-columns-in-a-search-query-splunk/m-p/362660#M165135 <P>Hi Guys,</P> <P>I have a simple question. I have a search query, and it basically outputs lots of fields. Is there a way of filter for a specific column in the search query?</P> <P>index=xxx sourcetype=xxx host=xxx OR host=xxx| eval UNIQUE=toString(xx)| eventstats dc(host) as ID by UNIQUE | where ID=2 | eval raw=toString(YYYY)| stats values(host) AS hosts BY raw | where mvcount(hosts) = 1 | replace xxx with xxx, xxx with xxxin hosts</P> <P>Kind Regards<BR /> Mahbs</P> Wed, 15 Nov 2017 11:45:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-columns-in-a-search-query-splunk/m-p/362660#M165135 mahbs 2017-11-15T11:45:02Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-columns-in-a-search-query-splunk/m-p/362661#M165136 <P>Hi </P> <P>Have you tried <CODE>fields</CODE> command ?</P> <P>eg.<BR /> ... | fields host, ip | fields - _*</P> <P>Doc: <A href="http://docs.splunk.com/Documentation/Splunk/7.0.0/SearchReference/Fields">http://docs.splunk.com/Documentation/Splunk/7.0.0/SearchReference/Fields</A></P> <P>Thanks</P> Wed, 15 Nov 2017 11:52:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-columns-in-a-search-query-splunk/m-p/362661#M165136 kamlesh_vaghela 2017-11-15T11:52:30Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-columns-in-a-search-query-splunk/m-p/362662#M165137 <P>Hi mahbs,<BR /> you can use the <CODE>table</CODE> command ( <A href="https://docs.splunk.com/Documentation/Splunk/7.0.0/SearchReference/Table">https://docs.splunk.com/Documentation/Splunk/7.0.0/SearchReference/Table</A> ) to display only the requested fields or <CODE>fields - fieldname</CODE> ( <A href="https://docs.splunk.com/Documentation/Splunk/7.0.0/SearchReference/Fields">https://docs.splunk.com/Documentation/Splunk/7.0.0/SearchReference/Fields</A> ) to hide some column.<BR /> Bye.<BR /> Giuseppe</P> Wed, 15 Nov 2017 11:54:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-columns-in-a-search-query-splunk/m-p/362662#M165137 gcusello 2017-11-15T11:54:01Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-columns-in-a-search-query-splunk/m-p/362663#M165138 <P>or to add onto this, use the <CODE>fields field1 field2....</CODE> to show fields, instead of the <CODE>table</CODE> command</P> Wed, 15 Nov 2017 12:51:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-columns-in-a-search-query-splunk/m-p/362663#M165138 cmerriman 2017-11-15T12:51:02Z