The title says it all. I'm looking for a way to remove fields from searches and subsearches. I know I can hide fields from results with
| fields - "fieldName"
But I'm looking for a way to get "set diff" to operate on a singe filed. If I was using "diff" without "set" the the attribute parameter could be utilized but unfortunately this option seems to be disabled when the two are used in conjunction.
Search in a stats count by type search and then only redirect the interesting fields to a table, the results will only be the fields you send to the table.
Does that help?
What's your current search(es)?
Could you create an expanded example of the SPL perhaps using | makeresults
to generate the data for a standalone example?