5.4 table, rename, fields, dedup, and sort

5.4 table, rename, fields, dedup, and sort

Blueprint objective 4.4 explicitly lists five commands Users must be able to apply: table, rename, fields, dedup, and sort. These commands usually appear after a selective base search. They do not replace index= or field=value filters; they organize, reduce, and present the events you already retrieved.

Command Map at a Glance

1) fields — Keep or Remove Fields

Purpose

fields controls which fields remain in the result set. It is about field selection, not about choosing which events match (that is what the base search/search command does).

Syntax patterns

Keep only certain fields:

... | fields host, status, clientip

Remove fields:

... | fields - useragent, referer

Wildcard removals/keeps are commonly taught in Splunk training forms such as:

... | fields - _*

(Use internal-field removals carefully; some commands expect internal fields like _time.)

Examples

index=web sourcetype=access_combined status=500
| fields _time, host, clientip, status, uri_path

index=security action=failed
| fields - punct, date_*

Exam notes

• fields helps readability and can improve efficiency by discarding unneeded field data before later stages.
• fields is not a substitute for status=500 in the base search.
• A brief contrast: where/eval can build conditional logic later, but User objective 4.4 is testing fields field inclusion/exclusion—not eval expressions.

2) table — Display Specific Columns

Purpose

table returns a table of the specified fields. Column order follows the order you list. Rows are the events/results flowing into the command.

Syntax

... | table <field1>, <field2>, <field3>, ...

Examples

index=web sourcetype=access_combined status=5*
| table _time, host, clientip, status, uri_path

index=security sourcetype=linux_secure action=failed
| table _time, user, src, host
| sort - _time

table vs fields

In many User workflows you may see either command used to narrow columns; for exam wording, if the question says display as a table with specific columns, prefer table.

3) rename — Rename Fields

Purpose

rename changes field names so headers are clearer in reports/tables or so names match a preferred label.

Syntax

... | rename <old_field> AS <new_field>

Multiple renames:

... | rename clientip AS src_ip, status AS http_status

Wildcards can rename groups of fields in more advanced patterns; for User focus, master the AS form first.

Examples

index=web sourcetype=access_combined status=500
| stats count BY clientip
| rename clientip AS src_ip, count AS error_count
| table src_ip, error_count
| sort - error_count

index=security action=failed
| table _time, user, host
| rename user AS username, host AS device

Exam notes

• After renaming, downstream commands must use the new names.
• Renaming does not change underlying stored index data; it changes names in the search result pipeline.
• Quotes may be needed for new names with spaces: rename count AS "Error Count".

4) dedup — Remove Duplicates

Purpose

dedup removes subsequent duplicate events based on one or more specified fields, keeping the first event(s) for each unique field-value combination in the incoming order.

Because Splunk event searches typically return newest-first, “first retained” often means the most recent event per key unless sorting changed order earlier.

Syntax

... | dedup <field>
... | dedup <field1>, <field2>
... | dedup <N> <field>

Examples

Keep the newest event per user (given default reverse-time order):

index=vpn action=login
| dedup user
| table _time, user, src_ip

Dedup on a combination of fields:

index=security action=failed
| dedup user, src
| table _time, user, src, host

Keep two events per client IP:

index=web status=500
| dedup 2 clientip
| table _time, clientip, status, uri_path

Useful options (awareness level)

For most User exam items, knowing that dedup removes duplicates for listed fields and that an optional count keeps N per value is enough.

5) sort — Order Results

Purpose

sort orders results by one or more fields ascending or descending.

Syntax

... | sort <field>
... | sort -<field>
... | sort <field1>, -<field2>
... | sort <limit> -<field>

• Ascending: sort status or sort +status
• Descending: sort -status
• Limit while sorting: sort 10 -count

Examples

index=web sourcetype=access_combined status=500
| stats count BY host
| sort - count

index=web sourcetype=access_combined
| table _time, status, clientip, bytes
| sort status, - bytes

index=security action=failed
| stats count BY user
| sort 5 - count

Exam notes

• Default direction is ascending if not marked.
• Sort after aggregation when you need top talkers by count.
• Sorting huge raw event sets without limits can be expensive—filter/aggregate first when possible.

Putting All Five Together

Example A — Clean investigation table

index=web sourcetype=access_combined status=5*
| fields _time, host, clientip, status, uri_path, useragent
| dedup clientip
| rename clientip AS src_ip
| table _time, host, src_ip, status, uri_path
| sort - _time

Stage reading:

1. Retrieve server-error web events.
2. Keep relevant fields.
3. One row per client IP.
4. Rename for clarity.
5. Display columns.
6. Newest first.

Example B — Ranked summary prep (with stats awareness)

stats is Domain 5, but Users often combine 4.4 commands around it:

index=security action=failed
| stats count BY user
| rename count AS failures
| table user, failures
| sort 10 - failures

Here rename, table, and sort finalize a ranked failures list.

Example C — fields vs table choice

If the question is “remove unnecessary fields but continue processing events,” lean fields.

If the question is “show only these columns in a table,” lean table.

Decision Guide

Common Mistakes Across the Five Commands

Objective 4.4 Study Drill

For each command, practice until you can write one correct pipeline from memory:

1. fields keep list
2. fields remove list
3. table three columns
4. rename with AS
5. dedup one field and two fields
6. sort descending with and without a numeric limit

If you can combine all five in one coherent search and explain each stage left to right, you have closed Domain 4.0’s command requirement for the Splunk Core Certified User exam.