Splunk Search

Is there a shortcut to piping the table command where splunk-created fields are automatically excluded?

morethanyell
Builder

Given that my search criteria is this: index=some_index sourcetype=some_sourcetype, is there a shortcut to piping the | table * command where splunk-created fields are automatically excluded? (Basically wanted to do this: | fields - _raw, _time, eventtype, host, index, sourcetype, source, linecount, splunk_server, splunk_server_group, timestamp, punct in the shortest possible way.

0 Karma
1 Solution

niketn
Legend

@morethanyell, you can create a macro for excluding Splunk's default fields and use that macro in your searches. for example your macro code can be | fields - _* date_* .....

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@morethanyell, you can create a macro for excluding Splunk's default fields and use that macro in your searches. for example your macro code can be | fields - _* date_* .....

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

morethanyell
Builder

@niketnilay The noob in me is slapping me. Thank you. I did not think of that.

0 Karma

niketn
Legend

@morethanyell there is always first time for everything 🙂 Now you know.

I have converted my comment to answer. Please accept to mark this question as answered!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...