Hello I am currently using this code to return a search but its giving me all the fields and I only want certain ones. I was hoping I could pass parameters in somewhere and filter them but can't figure this out. Any help
$job = $service->getJobs()->create($search, array('rf' => '_time'));
$results = $job->getResults();
foreach ($results as $result)
{
if ($result instanceof Splunk_ResultsFieldOrder)
{
// Process the field order
printf ("FIELDS: " . implode(',', $result->getFieldNames()) . "\r\n");
You can solve this by simply adjusting your Splunk Search to return only the fields you are interested in by using the "fields" command.
Examples :
index=foo sourcetype=goo | fields field1, field2
index=foo sourcetype=goo | fields - _* | fields + field1, field2
Let Splunk do the work for you.