Search Line Filtering

[Jared_Copeland]

Hi I am new to splunk and hopefully this is a simple question to answer, i need to filter certain lines from the splunk event results here is an example of what i would like to do:

imagine a search result of 40 lines such as

category=7
computername=edas100
eventcode=624
eventtype=4
logfile=security

i only want to see information on eventcode and eventtype and the other information is not important to me

how can i format my search or how can i format the data after to hide all other fields except the ones i want to see (eventcode and eventtype for this example)

thanks very much for any help!

[southeringtonp]

If you want to do it interactively, use the field picker to pull out the fields you want, and click on the 'Events Viewer' square icon (the middle one) above the search results.

If you want it as a fixed part of the search try using fields or particularly table:

| table eventcode, eventtype