Dashboards & Visualizations

List some index iis fields in dropdown

Bassik
Path Finder

I am able to list all fields/columns from the index however I only want to list a few and not all (*)

I cannot seem to find a way to restrict the display of some columns. Is there a way to limit the list in a drop-down?

My current search is:

sourcetype=iis | fieldsummary | table field

Labels (1)
0 Karma
1 Solution

robinettdonWY
Path Finder

building on @493669 suggestion

sourcetype=iis | fieldsummary  | where in(field, "fieldslisted1", "fieldslisted2") | table field

View solution in original post

0 Karma

to4kawa
Ultra Champion
sourcetype=iis your_field::* OR your_field2::* ...

I am able to list all fields/columns from the index
fieldsummary keeps search time extract fields also.

0 Karma

robinettdonWY
Path Finder

building on @493669 suggestion

sourcetype=iis | fieldsummary  | where in(field, "fieldslisted1", "fieldslisted2") | table field
0 Karma

Bassik
Path Finder

Awesome worked

0 Karma

493669
Super Champion

In which way you want to limit the list..there are many ways by which you can limit list like you can use head command like below - It will display first 10 values-

sourcetype=iis | fieldsummary | table field|head 10
0 Karma

Bassik
Path Finder

I would like to only list ones I specify

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...