Splunk Search

Remove fields from a query

kahless1985
Explorer

The title says it all. I'm looking for a way to remove fields from searches and subsearches. I know I can hide fields from results with

| fields - "fieldName"

But I'm looking for a way to get "set diff" to operate on a singe filed. If I was using "diff" without "set" the the attribute parameter could be utilized but unfortunately this option seems to be disabled when the two are used in conjunction.

0 Karma

mydog8it
Builder

Search in a stats count by type search and then only redirect the interesting fields to a table, the results will only be the fields you send to the table.
Does that help?

0 Karma

somesoni2
Revered Legend

What's your current search(es)?

0 Karma

msivill_splunk
Splunk Employee
Splunk Employee

Could you create an expanded example of the SPL perhaps using | makeresults to generate the data for a standalone example?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...