Splunk Search

How to exclude certain fields from search results?

Yaichael
Communicator

I would like to exclude certain fields from search results and keep the rest of the information (not discarding the event), so Splunk can send it to an email later on.

For example. Let's say I have the following event:

devname = foo , devid = uuid , msg = info

Then, I discard devname = foo

devid = uuid , msg = info
Finally, send configured event to email.

Is there a way to do this?

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try ... | fields - devname | ...

---
If this reply helps you, Karma would be appreciated.

View solution in original post

MuS
Legend

Hi Yaichael,

you can use either fields or table to specify the fields which should be used further in Splunk:

 Your base search here | fields devid msg | do more stuff here

or

Your base search here | table devid msg | do more stuff here

The difference between fields and table is that table only keeps those fields specified in a table format, where as fields also provides fields like _time and _raw as well in the event set.
Hope this helps ...

cheers, MuS

richgalloway
SplunkTrust
SplunkTrust

Try ... | fields - devname | ...

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...