Using PHP SDK to filter fields

EricLloyd79 — Fri, 15 Nov 2013 17:22:39 GMT

Hello I am currently using this code to return a search but its giving me all the fields and I only want certain ones. I was hoping I could pass parameters in somewhere and filter them but can't figure this out. Any help

$job = $service->getJobs()->create($search, array('rf' => '_time'));

$results = $job->getResults();

foreach ($results as $result)
{
    if ($result instanceof Splunk_ResultsFieldOrder)
    {
        // Process the field order
        printf ("FIELDS: " . implode(',', $result->getFieldNames()) . "\r\n");

Re: Using PHP SDK to filter fields

Damien_Dallimor — Sun, 17 Nov 2013 09:32:04 GMT

You can solve this by simply adjusting your Splunk Search to return only the fields you are interested in by using the "fields" command.

Examples :

index=foo sourcetype=goo | fields field1, field2
index=foo sourcetype=goo | fields - _* | fields + field1, field2

Let Splunk do the work for you.

topic Re: Using PHP SDK to filter fields in Splunk Search

Using PHP SDK to filter fields

Re: Using PHP SDK to filter fields