Splunk Search

Using PHP SDK to filter fields

EricLloyd79
Builder

Hello I am currently using this code to return a search but its giving me all the fields and I only want certain ones. I was hoping I could pass parameters in somewhere and filter them but can't figure this out. Any help

$job = $service->getJobs()->create($search, array('rf' => '_time'));

$results = $job->getResults();

foreach ($results as $result)
{
    if ($result instanceof Splunk_ResultsFieldOrder)
    {
        // Process the field order
        printf ("FIELDS: " . implode(',', $result->getFieldNames()) . "\r\n");
Tags (4)
0 Karma

Damien_Dallimor
Ultra Champion

You can solve this by simply adjusting your Splunk Search to return only the fields you are interested in by using the "fields" command.

Examples :

index=foo sourcetype=goo | fields field1, field2
index=foo sourcetype=goo | fields - _* | fields + field1, field2

Let Splunk do the work for you.

Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...