Dashboards & Visualizations

List some index iis fields in dropdown

Bassik
Path Finder

I am able to list all fields/columns from the index however I only want to list a few and not all (*)

I cannot seem to find a way to restrict the display of some columns. Is there a way to limit the list in a drop-down?

My current search is:

sourcetype=iis | fieldsummary | table field

Labels (1)
0 Karma
1 Solution

robinettdonWY
Path Finder

building on @493669 suggestion

sourcetype=iis | fieldsummary  | where in(field, "fieldslisted1", "fieldslisted2") | table field

View solution in original post

0 Karma

to4kawa
Ultra Champion
sourcetype=iis your_field::* OR your_field2::* ...

I am able to list all fields/columns from the index
fieldsummary keeps search time extract fields also.

0 Karma

robinettdonWY
Path Finder

building on @493669 suggestion

sourcetype=iis | fieldsummary  | where in(field, "fieldslisted1", "fieldslisted2") | table field
0 Karma

Bassik
Path Finder

Awesome worked

0 Karma

493669
Super Champion

In which way you want to limit the list..there are many ways by which you can limit list like you can use head command like below - It will display first 10 values-

sourcetype=iis | fieldsummary | table field|head 10
0 Karma

Bassik
Path Finder

I would like to only list ones I specify

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...