Splunk® Cloud Services

SPL2 Search Reference

Acrobat logo Download manual as PDF

Acrobat logo Download topic as PDF

fields command examples

The following are examples for using the SPL2 fields command. To learn more about the fields command, see How the SPL2 fields command works.

1. Specify a list of fields to include in the search results

Return only the host and src fields from the search results.

... | fields host, src

2. Specify a list of fields to remove from the search results

Use the negative ( - ) symbol to specify which fields to remove from the search results. In this example, remove the host and ip fields from the results.

... | fields - host, ip

3. Remove all internal fields from the search results

Internal fields are returned by default. All internal fields begin with an underscore character, for example _time. Use a wild card character ( * ) after the underscore to specify all internal fields. This example keep only the host and ip fields, and remove all of the internal fields.

... | fields host, ip | fields - '_*'

4. Remove specific internal fields from the search results

Remove unwanted internal fields from the results. The fields to exclude are _raw, _indextime, _sourcetype, _subsecond, and _serial.

| from _internal where sourcetype="splunkd" | head 5 | fields - _raw, _indextime, _sourcetype, _subsecond, _serial

5. Store the results in a KV lookup dataset

Keep the host and ip fields. Remove all internal fields from the search results. Store the results in a KV lookup dataset.

...| fields host, ip | fields - '_*' | into myKVlookup

6. Use a wildcard to specify multiple fields that start with a similar name

Keep only the fields source, sourcetype, host, and all fields that begin with error. Because a wildcard is used, the field name must be enclosed in single quotation marks.

... | fields source, sourcetype, host, 'error*'

See also

fields command
fields command overview
fields command syntax details
fields command usage
Last modified on 31 January, 2024
fields command usage
fieldsummary command overview

This documentation applies to the following versions of Splunk® Cloud Services: current

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters