how to remove few content from splunk output

[avi123]

Hi All,

I have a splunk query giving results in this format:
Time                                                             Event
3/10/25 10:52:15.000 AM                 { [-]
                                                                         BCDA_AB_CD_01: 1
                                                                         BCAD_AB__02: 0
                                                                         BCDA_AB_DC: 1
                                                                         BCAD_CD_02: 0
                                                                        }

However I want to remove the BCAD_AB__02 and BCAD_CD_02 from the output. Please help me write a splunk query to exclude these two values from the output. I tried doing  | fields - BCAD_AB__02 BCAD_CD_02 
but this didn't work

[livehybrid]

Hi @avi123 

How about this?

You can remove the fields as you are doing, then do | tojson

Here is a sample SPL

| makeresults 
| eval _raw=json_extract("{\"BCDA_AB_CD_01\": 1, \"BCAD_AB__02\": 0, \"BCDA_AB_DC\": 1, \"BCAD_CD_02\": 0}","")
| spath input=_raw
| fields - BCAD_CD_02 BCAD_AB__02
| tojson

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

[gcusello]

Hi @avi123 ,

could you share the search and the field names you're using ?

Ciao.

Giuseppe