Splunk Search

Search Line Filtering

New Member

Hi I am new to splunk and hopefully this is a simple question to answer, i need to filter certain lines from the splunk event results here is an example of what i would like to do:

imagine a search result of 40 lines such as

category=7
computername=edas100
eventcode=624
eventtype=4
logfile=security

i only want to see information on eventcode and eventtype and the other information is not important to me

how can i format my search or how can i format the data after to hide all other fields except the ones i want to see (eventcode and eventtype for this example)

thanks very much for any help!

Tags (3)
0 Karma

Motivator

If you want to do it interactively, use the field picker to pull out the fields you want, and click on the 'Events Viewer' square icon (the middle one) above the search results.

If you want it as a fixed part of the search try using fields or particularly table:

| table eventcode, eventtype
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!