Splunk Search

Using PHP SDK to filter fields

EricLloyd79
Builder

Hello I am currently using this code to return a search but its giving me all the fields and I only want certain ones. I was hoping I could pass parameters in somewhere and filter them but can't figure this out. Any help

$job = $service->getJobs()->create($search, array('rf' => '_time'));

$results = $job->getResults();

foreach ($results as $result)
{
    if ($result instanceof Splunk_ResultsFieldOrder)
    {
        // Process the field order
        printf ("FIELDS: " . implode(',', $result->getFieldNames()) . "\r\n");
Tags (4)
0 Karma

Damien_Dallimor
Ultra Champion

You can solve this by simply adjusting your Splunk Search to return only the fields you are interested in by using the "fields" command.

Examples :

index=foo sourcetype=goo | fields field1, field2
index=foo sourcetype=goo | fields - _* | fields + field1, field2

Let Splunk do the work for you.

Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...