https://community.splunk.com/t5/Splunk-Search/How-to-Use-fields-to-remove-all-auto-generated-fields/m-p/124391#M33637 <P>Hello,<BR /> Basically, we want to get the rid of the system fields except _time , but leave the ones it picks up from our event, for example, get rid of date_mday, date_month etc. And keep the custom ones. is there any easy way to do this?</P> Mon, 28 Sep 2020 20:03:35 GMT markthompson 2020-09-28T20:03:35Z https://community.splunk.com/t5/Splunk-Search/How-to-Use-fields-to-remove-all-auto-generated-fields/m-p/124391#M33637 <P>Hello,<BR /> Basically, we want to get the rid of the system fields except _time , but leave the ones it picks up from our event, for example, get rid of date_mday, date_month etc. And keep the custom ones. is there any easy way to do this?</P> Mon, 28 Sep 2020 20:03:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Use-fields-to-remove-all-auto-generated-fields/m-p/124391#M33637 markthompson 2020-09-28T20:03:35Z https://community.splunk.com/t5/Splunk-Search/How-to-Use-fields-to-remove-all-auto-generated-fields/m-p/124392#M33638 <P>what do you mean get rid? </P> Fri, 29 May 2015 00:48:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Use-fields-to-remove-all-auto-generated-fields/m-p/124392#M33638 sk314 2015-05-29T00:48:44Z https://community.splunk.com/t5/Splunk-Search/How-to-Use-fields-to-remove-all-auto-generated-fields/m-p/124393#M33639 <P>Create a <CODE>macro</CODE> called <CODE>nofields</CODE> or something that consists of <CODE>fields - date_*</CODE> or whatever you like and then add it to all of your searches like this:</P> <PRE><CODE>... | `nofields` </CODE></PRE> Fri, 29 May 2015 01:45:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Use-fields-to-remove-all-auto-generated-fields/m-p/124393#M33639 woodcock 2015-05-29T01:45:24Z