How to filter columns in a search query splunk

[mahbs]

Hi Guys,

I have a simple question. I have a search query, and it basically outputs lots of fields. Is there a way of filter for a specific column in the search query?

index=xxx sourcetype=xxx host=xxx OR host=xxx| eval UNIQUE=toString(xx)| eventstats dc(host) as ID by UNIQUE | where ID=2 | eval raw=toString(YYYY)| stats values(host) AS hosts BY raw | where mvcount(hosts) = 1 | replace xxx with xxx, xxx with xxxin hosts

Kind Regards
Mahbs

[gcusello]

Hi mahbs,
you can use the table command ( https://docs.splunk.com/Documentation/Splunk/7.0.0/SearchReference/Table ) to display only the requested fields or fields - fieldname ( https://docs.splunk.com/Documentation/Splunk/7.0.0/SearchReference/Fields ) to hide some column.
Bye.
Giuseppe

[cmerriman]

or to add onto this, use the fields field1 field2.... to show fields, instead of the table command

[kamlesh_vaghela]

Hi

Have you tried fields command ?

eg.
... | fields host, ip | fields - _*

Doc: http://docs.splunk.com/Documentation/Splunk/7.0.0/SearchReference/Fields

Thanks