I am able to list all fields/columns from the index however I only want to list a few and not all (*)
I cannot seem to find a way to restrict the display of some columns. Is there a way to limit the list in a drop-down?
My current search is:
sourcetype=iis | fieldsummary | table field
building on @493669 suggestion
sourcetype=iis | fieldsummary | where in(field, "fieldslisted1", "fieldslisted2") | table field
sourcetype=iis your_field::* OR your_field2::* ...
I am able to list all fields/columns from the index
fieldsummary
keeps search time extract fields also.
building on @493669 suggestion
sourcetype=iis | fieldsummary | where in(field, "fieldslisted1", "fieldslisted2") | table field
Awesome worked
In which way you want to limit the list..there are many ways by which you can limit list like you can use head command like below - It will display first 10 values-
sourcetype=iis | fieldsummary | table field|head 10
I would like to only list ones I specify