Dashboards & Visualizations

List some index iis fields in dropdown

Bassik
Path Finder

I am able to list all fields/columns from the index however I only want to list a few and not all (*)

I cannot seem to find a way to restrict the display of some columns. Is there a way to limit the list in a drop-down?

My current search is:

sourcetype=iis | fieldsummary | table field

Labels (1)
0 Karma
1 Solution

robinettdonWY
Path Finder

building on @493669 suggestion

sourcetype=iis | fieldsummary  | where in(field, "fieldslisted1", "fieldslisted2") | table field

View solution in original post

0 Karma

to4kawa
Ultra Champion
sourcetype=iis your_field::* OR your_field2::* ...

I am able to list all fields/columns from the index
fieldsummary keeps search time extract fields also.

0 Karma

robinettdonWY
Path Finder

building on @493669 suggestion

sourcetype=iis | fieldsummary  | where in(field, "fieldslisted1", "fieldslisted2") | table field
0 Karma

Bassik
Path Finder

Awesome worked

0 Karma

493669
Super Champion

In which way you want to limit the list..there are many ways by which you can limit list like you can use head command like below - It will display first 10 values-

sourcetype=iis | fieldsummary | table field|head 10
0 Karma

Bassik
Path Finder

I would like to only list ones I specify

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...