https://community.splunk.com/t5/Splunk-Search/How-to-show-only-Certain-Fields-of-the-Events-in-the-Search/m-p/106865#M27810 <P>How do I search and then show only show certain fields for each event?</P> <P>I tried: <CODE>remoteaccess host="ny-vpn" | fields Message</CODE> but this seems to only restrict the fields that are listed on the left part of the page, not the actual results. I also tried <CODE>... | fields Message | fields - _*</CODE> but then I only get the date.</P> <P>This is for WinEventLog items sent by the light forwarder.</P> Mon, 20 Dec 2010 23:25:24 GMT Kyle_Brandt 2010-12-20T23:25:24Z https://community.splunk.com/t5/Splunk-Search/How-to-show-only-Certain-Fields-of-the-Events-in-the-Search/m-p/106865#M27810 <P>How do I search and then show only show certain fields for each event?</P> <P>I tried: <CODE>remoteaccess host="ny-vpn" | fields Message</CODE> but this seems to only restrict the fields that are listed on the left part of the page, not the actual results. I also tried <CODE>... | fields Message | fields - _*</CODE> but then I only get the date.</P> <P>This is for WinEventLog items sent by the light forwarder.</P> Mon, 20 Dec 2010 23:25:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-show-only-Certain-Fields-of-the-Events-in-the-Search/m-p/106865#M27810 Kyle_Brandt 2010-12-20T23:25:24Z https://community.splunk.com/t5/Splunk-Search/How-to-show-only-Certain-Fields-of-the-Events-in-the-Search/m-p/106866#M27811 <P>Try </P> <PRE> remoteaccess host="ny-vpn" | fields + Message</PRE> <P>then use the Pick Fields link on the left to pick the fields and save.</P> <P>Then click the "Event Table" box-looking icon just above the results (the center one) and that should then only show the timestamp and the Message field.</P> <P>Also, you can save the search and then add it to a dashboard as a "Data Table" type and, then it will ONLY show the timestamp and the Message field by default</P> Mon, 20 Dec 2010 23:52:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-show-only-Certain-Fields-of-the-Events-in-the-Search/m-p/106866#M27811 maverick 2010-12-20T23:52:56Z https://community.splunk.com/t5/Splunk-Search/How-to-show-only-Certain-Fields-of-the-Events-in-the-Search/m-p/106867#M27812 <P>You can also use the <CODE>table</CODE> command to have Splunk show a table containing the fields you want:</P> <P><CODE>remoteaccess host="ny-vpn" | table Message</CODE></P> Tue, 21 Dec 2010 03:12:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-show-only-Certain-Fields-of-the-Events-in-the-Search/m-p/106867#M27812 Ayn 2010-12-21T03:12:17Z