Keeps or removes fields from search results based on the field list criteria.
By default, the internal fields
_time are included in output in Splunk Web. Additional internal fields are included in the output with the
outputcsv command. See Usage.
fields [+|-] <wc-field-list>
- Syntax: <field>, <field>, ...
- Description: Comma-delimited list of fields to keep or remove. You can use the asterisk ( * ) as a wildcard to specify a list of fields with similar names. For example, if you want to specify all fields that start with "value", you can use a wildcard such as
- + | -
- Syntax: + | -
- Description: If the plus ( + ) symbol is specified, only the fields in the
wc-field-listare kept in the results. If the negative ( - ) symbol is specified, the fields in the
wc-field-listare removed from the results.
- Default: +
fields command is a distributable streaming command. See Command types.
Internal fields and Splunk Web
The leading underscore is reserved for names of internal fields such as
_time. By default, the internal fields
_time are included in the search results in Splunk Web. The
fields command does not remove these internal fields unless you explicitly specify that the fields should not appear in the output in Splunk Web.
For example, to remove all internal fields, you specify:
... | fields - _*
To exclude a specific field, such as
_raw, you specify:
... | fields - _raw
Be cautious removing the
_time field. Statistical commands, such as
chart, cannot display date or time information without the
Displaying internal fields in Splunk Web
Other than the
_time fields, internal fields do not display in Splunk Web, even if you explicitly specify the fields in the search. For example, the following search does not show the
_bkt field in the results.
index=_internal | head 5 | fields + _bkt | table _bkt
To display an internal field in the results, the field must be copied or renamed to a field name that does not include the leading underscore character. For example:
index=_internal | head 5 | fields + _bkt | eval bkt=_bkt | table bkt
Internal fields and the outputcsv command
outputcsv command is used in the search, there are additional internal fields that are automatically added to the CSV file. The most common internal fields that are added are:
To exclude internal fields from the output, specify each field that you want to exclude. For example:
... | fields - _raw _indextime _sourcetype _serial | outputcsv MyTestCsvFile
You cannot match wildcard characters in searches that use the fields command
You can use the asterisk ( * ) in your searches as a wildcard character, but you can't use a backslash ( \ ) to escape an asterisk in search strings. A backslash
\ and an asterisk
* match the characters
\* in searches, not an escaped wildcard
* character. Because Splunk platform doesn't support escaping wildcards, asterisk ( * ) characters in field names can't be matched in searches that keep or remove fields from search results.
Support for backslash characters ( \ )
To match a backslash character ( \ ) in a field name when using the
fields command, use 2 backslashes for each backslash. For example, to display fields that contain
http:\\, use the following command in your search:
... | fields http:\\\\*
ip fields from the results
... | fields - host, ip
Keep only the
ip fields. Remove all of the internal fields. The internal fields begin with an underscore character, for example
... | fields host, ip | fields - _*
Remove unwanted internal fields from the output CSV file. The fields to exclude are
index=_internal sourcetype="splunkd" | head 5 | fields - _raw, _indextime, _sourcetype, _subsecond, _serial | outputcsv MyTestCsvfile
Keep only the fields
host, and all fields beginning with
... | fields source, sourcetype, host, error*
This documentation applies to the following versions of Splunk Cloud Platform™: 8.2.2202, 8.2.2112, 8.2.2201, 8.2.2203, 9.0.2205, 9.0.2208, 9.0.2209, 9.0.2303, 9.0.2305 (latest FedRAMP release)