Splunk Search

how to filter only desired fields from fetched events?

V_at_Splunk
Splunk Employee
Splunk Employee

In SQL-speak, "how to specify the columns in SELECT clause"? Normally, Splunk does the equivalent of SELECT *, which might not be wanted.

Tags (1)
1 Solution

V_at_Splunk
Splunk Employee
Splunk Employee

Say you want only field foo.

In 3.x, ... | FIELDS + foo

In 4.x, ... | FIELDS foo | FIELDS - _*

View solution in original post

V_at_Splunk
Splunk Employee
Splunk Employee

Say you want only field foo.

In 3.x, ... | FIELDS + foo

In 4.x, ... | FIELDS foo | FIELDS - _*

V_at_Splunk
Splunk Employee
Splunk Employee

_* refers to the reserved (a.k.a. "internal") fields such as _time.

So it seems to read "I want foo, and I don't want any internal fields".

The explanation at http://www.splunk.com/base/Documentation/latest/SearchReference/Fields might make more sense to you.

0 Karma

benstraw
Splunk Employee
Splunk Employee

what does the _* in the 4.x string mean? Why the underscore?

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>