topic how to remove few content from splunk output in Splunk Search

how to remove few content from splunk output

avi123 — Mon, 10 Mar 2025 10:15:02 GMT

Hi All,

I have a splunk query giving results in this format:
Time Event
3/10/25 10:52:15.000 AM { [-]
BCDA_AB_CD_01: 1
BCAD_AB__02: 0
BCDA_AB_DC: 1
BCAD_CD_02: 0
}

However I want to remove the BCAD_AB__02 and BCAD_CD_02 from the output. Please help me write a splunk query to exclude these two values from the output. I tried doing | fields - BCAD_AB__02 BCAD_CD_02
but this didn't work

Re: how to remove few content from splunk output

gcusello — Mon, 10 Mar 2025 10:17:59 GMT

Hi @avi123 ,

could you share the search and the field names you're using ?

Ciao.

Giuseppe

Re: how to remove few content from splunk output

livehybrid — Mon, 10 Mar 2025 14:55:14 GMT

Hi @avi123

How about this?

You can remove the fields as you are doing, then do | tojson

Here is a sample SPL

| makeresults | eval _raw=json_extract("{\"BCDA_AB_CD_01\": 1, \"BCAD_AB__02\": 0, \"BCDA_AB_DC\": 1, \"BCAD_CD_02\": 0}","") | spath input=_raw | fields - BCAD_CD_02 BCAD_AB__02 | tojson

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will