Splunk Search

Search Line Filtering

Jared_Copeland
New Member

Hi I am new to splunk and hopefully this is a simple question to answer, i need to filter certain lines from the splunk event results here is an example of what i would like to do:

imagine a search result of 40 lines such as

category=7
computername=edas100
eventcode=624
eventtype=4
logfile=security

i only want to see information on eventcode and eventtype and the other information is not important to me

how can i format my search or how can i format the data after to hide all other fields except the ones i want to see (eventcode and eventtype for this example)

thanks very much for any help!

Tags (3)
0 Karma

southeringtonp
Motivator

If you want to do it interactively, use the field picker to pull out the fields you want, and click on the 'Events Viewer' square icon (the middle one) above the search results.

If you want it as a fixed part of the search try using fields or particularly table:

| table eventcode, eventtype
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...