Splunk Search

Modify Splunk Output

nielsenr
New Member

So here's my problem, I'm using splunk to index some server logs. I am using the splunk javasdk to do a search and get the output as an xml file.
Now my question is can I limit the information splunk sends me? By editing my search I end up getting more information rather than less. For example things like the index and index time are of no use to me. any suggestions?

0 Karma
1 Solution

wcolgate_splunk
Splunk Employee
Splunk Employee

You can use features of the search language to remove unwanted fields from the reports.

For example (the ... is the actual search command like "search index=main *" then "pipe to" using "|".

Remove the "host" and "ip" fields.

... | fields - host, ip

Keep only the "host" and "ip" fields, and display them in the order: "host", "ip".

... | fields host, ip

Keep only the fields 'source', 'sourcetype', 'host', and all fields beginning with 'error'.

... | fields source, sourcetype, host, error*

etcetera. There is a easy-to-digest summary here: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SearchCheatSheet

View solution in original post

wcolgate_splunk
Splunk Employee
Splunk Employee

You can use features of the search language to remove unwanted fields from the reports.

For example (the ... is the actual search command like "search index=main *" then "pipe to" using "|".

Remove the "host" and "ip" fields.

... | fields - host, ip

Keep only the "host" and "ip" fields, and display them in the order: "host", "ip".

... | fields host, ip

Keep only the fields 'source', 'sourcetype', 'host', and all fields beginning with 'error'.

... | fields source, sourcetype, host, error*

etcetera. There is a easy-to-digest summary here: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SearchCheatSheet

wcolgate_splunk
Splunk Employee
Splunk Employee

One last thing. In the SDKs a search string always should start with "search ..." The broser GUI always assumes this and puts it there for you.

0 Karma
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...