Splunk Search

Is there a shortcut to piping the table command where splunk-created fields are automatically excluded?

morethanyell
Builder

Given that my search criteria is this: index=some_index sourcetype=some_sourcetype, is there a shortcut to piping the | table * command where splunk-created fields are automatically excluded? (Basically wanted to do this: | fields - _raw, _time, eventtype, host, index, sourcetype, source, linecount, splunk_server, splunk_server_group, timestamp, punct in the shortest possible way.

0 Karma
1 Solution

niketn
Legend

@morethanyell, you can create a macro for excluding Splunk's default fields and use that macro in your searches. for example your macro code can be | fields - _* date_* .....

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@morethanyell, you can create a macro for excluding Splunk's default fields and use that macro in your searches. for example your macro code can be | fields - _* date_* .....

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

morethanyell
Builder

@niketnilay The noob in me is slapping me. Thank you. I did not think of that.

0 Karma

niketn
Legend

@morethanyell there is always first time for everything 🙂 Now you know.

I have converted my comment to answer. Please accept to mark this question as answered!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...