Splunk Search

how to filter only desired fields from fetched events?

V_at_Splunk
Splunk Employee
Splunk Employee

In SQL-speak, "how to specify the columns in SELECT clause"? Normally, Splunk does the equivalent of SELECT *, which might not be wanted.

Tags (1)
1 Solution

V_at_Splunk
Splunk Employee
Splunk Employee

Say you want only field foo.

In 3.x, ... | FIELDS + foo

In 4.x, ... | FIELDS foo | FIELDS - _*

View solution in original post

V_at_Splunk
Splunk Employee
Splunk Employee

Say you want only field foo.

In 3.x, ... | FIELDS + foo

In 4.x, ... | FIELDS foo | FIELDS - _*

V_at_Splunk
Splunk Employee
Splunk Employee

_* refers to the reserved (a.k.a. "internal") fields such as _time.

So it seems to read "I want foo, and I don't want any internal fields".

The explanation at http://www.splunk.com/base/Documentation/latest/SearchReference/Fields might make more sense to you.

0 Karma

benstraw
Splunk Employee
Splunk Employee

what does the _* in the 4.x string mean? Why the underscore?

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...