topic Re: Output only specific field values to CLI in Splunk Search

Output only specific field values to CLI

jones4bob — Wed, 23 Jun 2010 23:59:59 GMT

I'm trying to pull data from the CLI to pipe to awk to pipe to ... I can't seem to find the correct syntax to say, for example, just pull a single field from a record, rather than pulling everything in each event. Older examples seem to indicate that I can pipe the search to 'fields + field1 field2' but this still only produces the entire event information. What am I missing?

Re: Output only specific field values to CLI

jones4bob — Thu, 24 Jun 2010 00:52:07 GMT

I think I've found what I was looking for.

The syntax for pulling specific fields appears to need to work like this: fields field1 field2 | fields - _*

It looks like that last pipe to fields is needed to remove the remainder of the fields from the search result. This worked for me and produced the desired output for awk to process.

Re: Output only specific field values to CLI

gkanapathy — Thu, 24 Jun 2010 03:59:49 GMT

you can also use the table search command instead of fields.

Re: Output only specific field values to CLI

swdonline — Fri, 30 Mar 2012 19:23:09 GMT

Interestingly, in 4.3.1, when I use this for the cli (which works fine in the GUI):
table a b c d e
I get these results:
a d e b c
Why would table return fields in a different order from the CLI?