Splunk Dev

Can I select specified fields with the Python SDK?

anshanno
Path Finder

I'd like to write a python script to select only certain fields such as the UI does (example below) and load them into a pandas dataframe.

alt text

0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

Yes, just use the fields command in your search string:

...|fields Action bug_id Host User

View solution in original post

jkat54
SplunkTrust
SplunkTrust

Yes, just use the fields command in your search string:

...|fields Action bug_id Host User

anshanno
Path Finder

Awesome, thank you so much! I wasn't able to find this in the documentation.

EDIT: is there away to get rid of the extra garbage too, I am presuming something like ...|exclude fields yada yada?

Action,User,"b_Project",Host,"_bkt","_cd","_indextime","_kv","_raw","_serial","_si","_sourcetype","_subsecond","_time"

0 Karma

jkat54
SplunkTrust
SplunkTrust

It's ... | fields - thisOne thatOne

minus removes... plus adds / technically works too if you need to add a blank field, or if you just want to be verbose

... | fields + Action bug_id Host User
is same as
... | fields Action bug_id Host User

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...