Fieldsummary output : remove columns I dont need.

[john_shashank]

eventtype=osquery_osquery name="pack_incident_response_*" earliest=-5m
| fieldsummary

output: A table contains multiple columns such as field, count, distinct_count, is_exact, .......etc.

Required output: only one column.

Not working :
|table -count, -distinct_count,

[codebuilder]

In your example, table will work but your syntax is not correct. Use table to include the values you want.

e.g.

eventtype=osquery_osquery name="pack_incident_response_*" earliest=-5m| fieldsummary | table field, count, max

[john_shashank]

Your command worked completed fine. but as there are multiple packs under the field called "name". I modified the query to the following which did not work for me can you help me with that?

eventtype=osquery_osquery name="pack_incident_response_*" earliest=-5m| fieldsummary | stats value(field), name

[codebuilder]

Yes. Take out the "name=", and instead use wildcards around the values.
e.g.
pack_incident_response_

Do the same for any others you want to include.

[codebuilder]

To clarify my previous post, try this method:

eventtype=osquery_osquery name="pack_incident_response_*" earliest=-5m| fieldsummary *pack_incident_response_* | table field, count, max

[to4kawa · Accepted solution]

use fields instead of table

[john_shashank]

Thanks, that worked,

I have one more question if you can help.

Query:
eventtype=osquery_osquery earliest=-5m
| stats values(fieldsummary) by name
[ | fieldsummary

| fields - count, - distinct_count, - is_exact, - max, - mean, - min, - numeric_count, - stdev, - values]

Looking for the result as :
2 column: name and the field (one column from the fieldsummary search)

Can you help me to modify the query to get the correct answer?

Thanks

[to4kawa]

@john_shashank
please accept my answer.

Your query is not clear. What are you going to know by this query?

ask for another question and provide sample log at the point.

Anyone can't see name and why do you use fieldsummary at this place?
osquery's output has name , I know. but I can't understand what you want to do.

@codebuilder
remove columns I dont need
For this Q, fields is appropriate. so, I think table is good, too.

[john_shashank]

I am trying to achieve something like in the picture below.
https://drive.google.com/open?id=1Atr-qDM68Dc_pLy7WsGFeiFbiEvvjha2

this is what I just created for an example. @to4kawa If there is any other way to extract field please feel free to share the syntax. thanks

[to4kawa]

Your query is not clear. What are you going to know by this query?
ask for another question and provide sample log at the point.

another way:

use map and search each name.

[codebuilder]

@to4kawa I agree with you, both options work in this case (fields or table), and your suggestion was first, and correct.

[codebuilder]

Did you read my answer?