
fields command syntax details
Syntax
The required syntax is in bold.
- fields [+|-] <field-list>
Required arguments
- field-list
- Syntax: <field>, <field>, ...
- Description: Comma-delimited list of fields to keep or remove. You can use a wild card character in the field names, but must enclose those field names in single quotation marks. For example
... | fields host, 'server*'
Optional arguments
- + | -
- Syntax: + | -
- Description: If the plus ( + ) symbol is specified, only the fields in the
field-list
are kept in the results. If the negative ( - ) symbol is specified, the fields in thefield-list
are removed from the results. The symbol you specify applies to all of the fields in thefield-list
. - Default: +
See also
- fields command
- fields command overview
- fields command usage
- fields command examples
Last modified on 05 October, 2021
PREVIOUS fields command overview |
NEXT fields command usage |
This documentation applies to the following versions of Splunk® Cloud Services: current
Feedback submitted, thanks!