Splunk Search

Remove 'Select/Show in Results' from search results

I-Man
Communicator

I created a payload field that usually has about 8-20 lines of data. After the field was created, I clicked the field in the left hand section of the Search App and accidentally hit "Select/Show in results". Now I have a huge section of fields between each event due to the payload field containing so much data.

How do i remove this from showing in the search results? I looked everywhere and there does not seem to be an option to do this.

Thanks,
I-Man.

Tags (3)
0 Karma
1 Solution

Ayn
Legend
  1. Click "Pick fields" to the left in the Search app
  2. In the dialog that pops up, the list of fields that are shown in results are listed on the right-hand side under "Selected Fields". Remove those you don't want.

View solution in original post

0 Karma

Ayn
Legend
  1. Click "Pick fields" to the left in the Search app
  2. In the dialog that pops up, the list of fields that are shown in results are listed on the right-hand side under "Selected Fields". Remove those you don't want.
0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...