I am able to list all fields/columns from the index however I only want to list a few and not all (*)
I cannot seem to find a way to restrict the display of some columns. Is there a way to limit the list in a drop-down?
My current search is:
sourcetype=iis | fieldsummary | table field
In which way you want to limit the list..there are many ways by which you can limit list like you can use head command like below - It will display first 10 values-
sourcetype=iis | fieldsummary | table field|head 10