Dashboards & Visualizations

List some index iis fields in dropdown

Bassik
Path Finder

I am able to list all fields/columns from the index however I only want to list a few and not all (*)

I cannot seem to find a way to restrict the display of some columns. Is there a way to limit the list in a drop-down?

My current search is:

sourcetype=iis | fieldsummary | table field

Labels (1)
0 Karma
1 Solution

robinettdonWY
Path Finder

building on @493669 suggestion

sourcetype=iis | fieldsummary  | where in(field, "fieldslisted1", "fieldslisted2") | table field

View solution in original post

0 Karma

to4kawa
Ultra Champion
sourcetype=iis your_field::* OR your_field2::* ...

I am able to list all fields/columns from the index
fieldsummary keeps search time extract fields also.

0 Karma

robinettdonWY
Path Finder

building on @493669 suggestion

sourcetype=iis | fieldsummary  | where in(field, "fieldslisted1", "fieldslisted2") | table field
0 Karma

Bassik
Path Finder

Awesome worked

0 Karma

493669
Super Champion

In which way you want to limit the list..there are many ways by which you can limit list like you can use head command like below - It will display first 10 values-

sourcetype=iis | fieldsummary | table field|head 10
0 Karma

Bassik
Path Finder

I would like to only list ones I specify

0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...