Modify Splunk Output

[nielsenr]

So here's my problem, I'm using splunk to index some server logs. I am using the splunk javasdk to do a search and get the output as an xml file.
Now my question is can I limit the information splunk sends me? By editing my search I end up getting more information rather than less. For example things like the index and index time are of no use to me. any suggestions?

[wcolgate_splunk · Accepted solution]

You can use features of the search language to remove unwanted fields from the reports.

For example (the ... is the actual search command like "search index=main *" then "pipe to" using "|".

Remove the "host" and "ip" fields.

... | fields - host, ip

Keep only the "host" and "ip" fields, and display them in the order: "host", "ip".

... | fields host, ip

Keep only the fields 'source', 'sourcetype', 'host', and all fields beginning with 'error'.

... | fields source, sourcetype, host, error*

etcetera. There is a easy-to-digest summary here: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SearchCheatSheet

[wcolgate_splunk]

One last thing. In the SDKs a search string always should start with "search ..." The broser GUI always assumes this and puts it there for you.