Splunk Search

How to remove columns from search results table?

halkelley
Path Finder

This question was asked before, but not really answered. I have a search that returns columns dynamically created so I don't know the specific column/field names to include, but I do know the columns/fields that I need to remove so the graph will total and display properly. Is there a way to remove those columns?

Tags (3)
1 Solution

pradeepkumarg
Influencer

Are you looking for fields command?

Remove the "host" and "ip" fields.

... | fields - host, ip

More information in this link

http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/Fields

View solution in original post

Akbari
New Member

Table Name:TempDay
Filed Name: AttendanceDate
Code:
Dim curDatabase As DAO.Database
Dim tblPersons As DAO.TableDef
Set curDatabase = CurrentDb
Set TempDay = curDatabase.TableDefs("TempDay")
DoCmd.RunSQL "ALTER TABLE TempDay DROP COLUMN AttendanceDate"
‘For deleting more than one column try below
DoCmd.RunSQL "ALTER TABLE TempDay DROP COLUMN Second Column Name"
DoCmd.RunSQL "ALTER TABLE TempDay DROP COLUMN Third Column Name"

0 Karma

linu1988
Champion

the question is not that clear but you can always use |fields -col1,col2 to remove the column. There is no harm if they don't exist as well..

pradeepkumarg
Influencer

Are you looking for fields command?

Remove the "host" and "ip" fields.

... | fields - host, ip

More information in this link

http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/Fields

stufty
Path Finder

very useful - thank you

0 Karma

pradeepkumarg
Influencer

You're welcome 🙂

0 Karma

halkelley
Path Finder

thanks! I didn't realize fields had a "-" option!

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0

    Are you ready to transform how your team handles complex data requests? We invite you to our upcoming ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...