Why is the SPL is not removing the 'status' from the output while the below one is ?

[SumanPalisetty]

Hi,

I have a question on 'fields' please. 

sourcetype=* status IN ("200", "400","500")
| fields -status
| stats count by status

The SPL is not removing the 'status' from the output while the below one is removing. Why isn't the first working?

sourcetype=* status IN ("200", "400","500")
| fields - status
| stats count by status

Regards

Suman P.

[gcusello · Accepted solution]

Hi @SumanPalisetty,

because this is the sintax of this command that differs from other commands e.g. sort.

More information at https://docs.splunk.com/Documentation/SCS/current/SearchReference/FieldsCommandOverview

ciao.

Giuseppe

[SumanPalisetty]

Hi Sir,

Actually there was a mistake in the training. So was confused.

Regards

Suman P.