Splunk Search

Exclude 'default'/'system' fields in `table *`

henricook
New Member

I've got a JSON event that I like to tabulate by using `index=myindex | table *`

When I do this though it includes some system fields, such as `host`, `index`, `linecount`, `punct`, `source`, `sourcetype`

Does anyone know if there's a way to exclude them without naming them all individually via a built in method/variable?

e.g. `index=myindex | fields - $SYSTEM_FIELDS$ | table *`

Thanks,

Henri

Labels (3)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@henricook 

Not sure there is Splunk Variable available globally for that. But you can go with your approach by removing all default fields.

like,

| fields - _indextime, _cd, _bkt, host, index, linecount, punct, source, sourcetype, splunk_server, timestamp,date_*

_raw and _time also default field we should keep it.  🙂 

Check below link for more details about Default Fields

https://docs.splunk.com/Documentation/Splunk/8.2.1/Knowledge/Usedefaultfields#Use_default_fields

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>