Splunk Search

How to exclude certain fields from search results?

Yaichael
Communicator

I would like to exclude certain fields from search results and keep the rest of the information (not discarding the event), so Splunk can send it to an email later on.

For example. Let's say I have the following event:

devname = foo , devid = uuid , msg = info

Then, I discard devname = foo

devid = uuid , msg = info
Finally, send configured event to email.

Is there a way to do this?

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try ... | fields - devname | ...

---
If this reply helps you, Karma would be appreciated.

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi Yaichael,

you can use either fields or table to specify the fields which should be used further in Splunk:

 Your base search here | fields devid msg | do more stuff here

or

Your base search here | table devid msg | do more stuff here

The difference between fields and table is that table only keeps those fields specified in a table format, where as fields also provides fields like _time and _raw as well in the event set.
Hope this helps ...

cheers, MuS

richgalloway
SplunkTrust
SplunkTrust

Try ... | fields - devname | ...

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...