Splunk Search
Highlighted

Is there a shortcut to piping the table command where splunk-created fields are automatically excluded?

Contributor

Given that my search criteria is this: index=some_index sourcetype=some_sourcetype, is there a shortcut to piping the | table * command where splunk-created fields are automatically excluded? (Basically wanted to do this: | fields - _raw, _time, eventtype, host, index, sourcetype, source, linecount, splunk_server, splunk_server_group, timestamp, punct in the shortest possible way.

0 Karma
Highlighted

Re: Is there a shortcut to piping the table command where splunk-created fields are automatically excluded?

Legend

@morethanyell, you can create a macro for excluding Splunk's default fields and use that macro in your searches. for example your macro code can be | fields - _* date_* .....




| eval message="Happy Splunking!!!"


View solution in original post

0 Karma
Highlighted

Re: Is there a shortcut to piping the table command where splunk-created fields are automatically excluded?

Contributor

@niketnilay The noob in me is slapping me. Thank you. I did not think of that.

0 Karma
Highlighted

Re: Is there a shortcut to piping the table command where splunk-created fields are automatically excluded?

Legend

@morethanyell there is always first time for everything 🙂 Now you know.

I have converted my comment to answer. Please accept to mark this question as answered!




| eval message="Happy Splunking!!!"


0 Karma