This page explains how to use the project-away operator function in APL.
project-away
operator in APL is used to exclude specific fields from the output of a query. This operator is useful when you want to return a subset of fields from a dataset, without needing to manually specify every field you want to keep. Instead, you specify the fields you want to remove, and the operator returns all remaining fields.
You can use project-away
in scenarios where your dataset contains irrelevant or sensitive fields that you do not want in the results. It simplifies queries, especially when dealing with wide datasets, by allowing you to filter out fields without having to explicitly list every field to include.
Splunk SPL users
fields
command to remove fields from your results. In APL, the project-away
operator provides a similar functionality, removing specified fields while returning the remaining ones.ANSI SQL users
SELECT
statement to explicitly include fields. In contrast, APL’s project-away
operator allows you to exclude fields, offering a more concise approach when you want to keep many fields but remove a few.FieldName
: The field you want to exclude from the result set.project-away
operator returns the input dataset excluding the specified fields. The result contains the same number of rows as the input table.
_time | req_duration_ms | id | geo.city | geo.country |
---|---|---|---|---|
2023-10-17 10:23:00 | 120 | u1 | Seattle | USA |
2023-10-17 10:24:00 | 135 | u2 | Berlin | Germany |
status
, uri
, and method
fields from the output, keeping the focus on the key fields.data*
or ['data.fo']*
.
Here’s how you can use wildcards in project-away
:
project
operator lets you select specific fields to include, rather than excluding them.extend
operator is used to add new fields, whereas project-away
is for removing fields.project-away
removes fields, summarize
is useful for aggregating data across multiple fields.