Dashboards & Visualizations

List some index iis fields in dropdown

Bassik
Path Finder

I am able to list all fields/columns from the index however I only want to list a few and not all (*)

I cannot seem to find a way to restrict the display of some columns. Is there a way to limit the list in a drop-down?

My current search is:

sourcetype=iis | fieldsummary | table field

Labels (1)
0 Karma
1 Solution

robinettdonWY
Path Finder

building on @493669 suggestion

sourcetype=iis | fieldsummary  | where in(field, "fieldslisted1", "fieldslisted2") | table field

View solution in original post

0 Karma

to4kawa
Ultra Champion
sourcetype=iis your_field::* OR your_field2::* ...

I am able to list all fields/columns from the index
fieldsummary keeps search time extract fields also.

0 Karma

robinettdonWY
Path Finder

building on @493669 suggestion

sourcetype=iis | fieldsummary  | where in(field, "fieldslisted1", "fieldslisted2") | table field
0 Karma

Bassik
Path Finder

Awesome worked

0 Karma

493669
Super Champion

In which way you want to limit the list..there are many ways by which you can limit list like you can use head command like below - It will display first 10 values-

sourcetype=iis | fieldsummary | table field|head 10
0 Karma

Bassik
Path Finder

I would like to only list ones I specify

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...