Splunk Search

Search Line Filtering

Jared_Copeland
New Member

Hi I am new to splunk and hopefully this is a simple question to answer, i need to filter certain lines from the splunk event results here is an example of what i would like to do:

imagine a search result of 40 lines such as

category=7
computername=edas100
eventcode=624
eventtype=4
logfile=security

i only want to see information on eventcode and eventtype and the other information is not important to me

how can i format my search or how can i format the data after to hide all other fields except the ones i want to see (eventcode and eventtype for this example)

thanks very much for any help!

Tags (3)
0 Karma

southeringtonp
Motivator

If you want to do it interactively, use the field picker to pull out the fields you want, and click on the 'Events Viewer' square icon (the middle one) above the search results.

If you want it as a fixed part of the search try using fields or particularly table:

| table eventcode, eventtype
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...