Only show fields that has the word Read in them

[ChristofferK]

Hello!

I have the following search:

| mstats avg(*) as * WHERE index=indexhere host=hosthere span=1 by host
|timechart span=1m latest(*) as * 

What i am trying to do is only show the fields that contains the word "read" somewhere in the field name.

Each field name is different and doesn't have "read" in the same place or before/after the same special characters either. I have tried fixing with with different commands but can't seem to find a good solution. 

Thanks in advance

[richgalloway · Accepted solution]

Have you tried | fields *Read*  ?