Splunk Search

Which command is used to take away a field from the results display?

New Member

Is there a specific command that we use to take away a field from the results displayed?

0 Karma


There are two ways to do that, and they have different effects -

** FIELDS **

| fields - myfield
| fields + keepfield1 keepfield2 ... keepfieldX

The fields command is a distributable, streaming command. The first one removes myfield, the second one removes all fields except the listed ones, but also leaves the internal fields like _time. There is no limit on the number of records that can pass through the fields command.

** TABLE **

| table keepfield1 keepfield2 ... keepfieldX

The table command is NOT a streaming command, it is a transforming command. It keeps only the listed fields, deleting all internal fields that aren't listed, and formats the result as a table. WARNING - Table has a limit to the number of results it puts out.

0 Karma


@splunkerkanaka, it should be | fields - <YourFieldToBeRemoved>
Refer to documentation on fields command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Fields

| makeresults | eval message= "Happy Splunking!!!"
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!