Is there a shortcut to piping the table command where splunk-created fields are automatically excluded?

[morethanyell]

Given that my search criteria is this: index=some_index sourcetype=some_sourcetype, is there a shortcut to piping the | table * command where splunk-created fields are automatically excluded? (Basically wanted to do this: | fields - _raw, _time, eventtype, host, index, sourcetype, source, linecount, splunk_server, splunk_server_group, timestamp, punct in the shortest possible way.

[niketn · Accepted solution]

@morethanyell, you can create a macro for excluding Splunk's default fields and use that macro in your searches. for example your macro code can be | fields - _* date_* .....

[morethanyell]

@niketnilay The noob in me is slapping me. Thank you. I did not think of that.

[niketn]

@morethanyell there is always first time for everything 🙂 Now you know.

I have converted my comment to answer. Please accept to mark this question as answered!