Splunk Search

Why is the SPL is not removing the 'status' from the output while the below one is ?

SumanPalisetty
Path Finder

Hi,

I have a question on 'fields' please. 

 

sourcetype=* status IN ("200", "400","500")
| fields -status
| stats count by status

 

The SPL is not removing the 'status' from the output while the below one is removing. Why isn't the first working?

 

sourcetype=* status IN ("200", "400","500")
| fields - status
| stats count by status

 

Regards

Suman P.

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @SumanPalisetty,

because this is the sintax of this command that differs from other commands e.g. sort.

More information at https://docs.splunk.com/Documentation/SCS/current/SearchReference/FieldsCommandOverview

ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @SumanPalisetty,

because this is the sintax of this command that differs from other commands e.g. sort.

More information at https://docs.splunk.com/Documentation/SCS/current/SearchReference/FieldsCommandOverview

ciao.

Giuseppe

SumanPalisetty
Path Finder

Hi Sir,

Actually there was a mistake in the training. So was confused.

training.png

Regards

Suman P.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...