How to only keep _time and _raw fields in the search results?

[karan1337]

I wish to keep only _time and _raw fields in the export output file. I read in the documentation that | fields - _* removes all internal fields, but how can i keep only internal specific fields in the output?

Also, when i use table i get _indextime and without it, i only see _time. Why is there a distinction between the fields i see in the same output when table or fields is used? The _time is in "2015-07-06 01:48:09.118 GMT" format whereas _indextime is in epoch format. How can i convert _time into equivalent epoch time?

[esix_splunk]

Be aware there are more differences between table and fields then just the stripping away of internal fields. Mainly related to statistically functions and reporting, but do note it can break searches..

http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Table
http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Fields

Use table command when you want to retain data in tabular format. The table command can be used to build a scatter plot to show trends in the relationships between discrete values of your data. Otherwise, you should not use it for charts (such as chart or timechart) because the UI requires the internal fields (which are the fields beginning with an underscore, _*) to render the charts, and the table command strips these fields out of the results by default. Instead, you should use the fields command because it always retains all the internal fields.

[MuS]

Hi karan1337,

you can this run everywhere search:

index=_internal | table _time _raw

and will only get _time and _raw in the output. _time is always epoch, but the UI will convert it to human readable time.
The distinction between the table and fields is that, table only keeps the provided fields where as fields keeps the internal fields as well.

Hope that helps ...

cheers, MuS

[karan1337]

@MuS What is index=_internal?

[MuS]

This is Splunk's internal index, see docs http://docs.splunk.com/Documentation/Splunk/6.2.3/Troubleshooting/WhatSplunklogsaboutitself

[esix_splunk]

_internal is the Splunk internal indexed, used for internal logging of metrics, errors, logins, search history, etc.