Splunk Search

How to Use fields to remove all auto generated fields


Basically, we want to get the rid of the system fields except _time , but leave the ones it picks up from our event, for example, get rid of date_mday, date_month etc. And keep the custom ones. is there any easy way to do this?

Tags (3)
0 Karma

Esteemed Legend

Create a macro called nofields or something that consists of fields - date_* or whatever you like and then add it to all of your searches like this:

... | `nofields`
0 Karma


what do you mean get rid?

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!