I'm reading syslog data and have a netfilter (iptables) firewall that logs entries that start with FW_. When doing a realtime search on FW_* I see all these entries. Down the left of the screen I have a list of interesting fields and MAC is one of them. I modify my search according the the search command cheat sheet to FW_* | fields - MAC and still see the MAC field in the search results.
Thanks for any help, Jeff
Hi Jeff,
If you use the fields commands like this it will only hide the field in the field list not directly in the result pane.
This command is usually used in | chart command to hide percent or count column.
http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Fields
Regards
Clement
Maybe you can try this.
http://splunk-base.splunk.com/answers/4396/is-it-possible-to-hide-_raw-from-a-search-result
So I guess I should have asked how do you filter the results pane?