topic Re: Does the fields command support globbing/wildcard matching? in Splunk Search

Does the fields command support globbing/wildcard matching?

chris — Thu, 05 Dec 2013 09:08:38 GMT

Im trying to reduce the fields of my resultset by using the fields command with the '-' option. This does not appear to work:

index=* | head 10 | eval ip="194.10.10.10" | table ip,_time | geoip ip | fields - ip_*

I can get around the problem for this case by searching differently:

index=* | head 10 | eval ip="194.10.10.10"  | geoip ip  | table ip,_time

...but I'm trying to find out how field command works.

The documentation shows an example where the * can be used if you want to keep fields (without using the '-').

This does work

index=* | head 10 | eval ip="194.10.10.10" | table ip,_time | geoip ip | fields ip_l*

This does not work:

index=* | head 10 | eval ip="194.10.10.10" | table ip,_time | geoip ip | fields - ip_l*

Any Ideas?

Thanks
Chris

Re: Does the fields command support globbing/wildcard matching?

Ayn — Thu, 05 Dec 2013 09:54:11 GMT

The two last examples seem to be identical?

Re: Does the fields command support globbing/wildcard matching?

chris — Thu, 05 Dec 2013 10:06:45 GMT

Hi Ayn, you're right. I forgot to insert the '-' option to the last command. I updated the question.

Re: Does the fields command support globbing/wildcard matching?

alacercogitatus — Thu, 05 Dec 2013 12:22:16 GMT

This works for me. What version are you using?

Re: Does the fields command support globbing/wildcard matching?

HattrickNZ — Tue, 29 Sep 2020 08:54:34 GMT

using 6.3.
having a similar issue:

For clarification:
| fields ip_l* this wild card will work in showing all the fields ip_l
but if I try and remove them.
| fields - ip_l* this does not remove the columns/field but it does remove the values in them columns ip_l*. I want the fields/columns to be removed as well.

hmmm....