fields command examples

The following are examples for using the SPL2 fields command. To learn more about the fields command, see How the SPL2 fields command works.

1. Specify a list of fields to include in the search results

Return only the host and src fields from the search results.

... | fields host, src

2. Specify a list of fields to remove from the search results

Use the negative ( - ) symbol to specify which fields to remove from the search results. In this example, remove the host and ip fields from the results.

... | fields - host, ip

3. Remove all internal fields from the search results

Internal fields are returned by default. All internal fields begin with an underscore character, for example _time. Use a wild card character ( * ) after the underscore to specify all internal fields. This example keep only the host and ip fields, and remove all of the internal fields.

... | fields host, ip | fields - '_*'

4. Remove specific internal fields from the search results

Remove unwanted internal fields from the results. The fields to exclude are _raw, _indextime, _sourcetype, _subsecond, and _serial.

| from _internal where sourcetype="splunkd" | head 5 | fields - _raw, _indextime, _sourcetype, _subsecond, _serial

5. Store the results in a KV lookup dataset

Keep the host and ip fields. Remove all internal fields from the search results. Store the results in a KV lookup dataset.

...| fields host, ip | fields - '_*' | into myKVlookup

6. Use a wildcard to specify multiple fields that start with a similar name

Keep only the fields source, sourcetype, host, and all fields that begin with error. Because a wildcard is used, the field name must be enclosed in single quotation marks.

... | fields source, sourcetype, host, 'error*'

See also

fields command

fields command overview

fields command syntax details

fields command usage