search filter not working (or I don't understand filtering)

[unyalli]

I'm reading syslog data and have a netfilter (iptables) firewall that logs entries that start with FW_. When doing a realtime search on FW_* I see all these entries. Down the left of the screen I have a list of interesting fields and MAC is one of them. I modify my search according the the search command cheat sheet to FW_* | fields - MAC and still see the MAC field in the search results.

Thanks for any help, Jeff

[ClementG]

Hi Jeff,

If you use the fields commands like this it will only hide the field in the field list not directly in the result pane.

This command is usually used in | chart command to hide percent or count column.

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Fields

Regards

Clement

[ClementG]

Maybe you can try this.

http://splunk-base.splunk.com/answers/4396/is-it-possible-to-hide-_raw-from-a-search-result

[unyalli]

So I guess I should have asked how do you filter the results pane?