How to get rid of fields/columns generated by stats and eval commands?

[sravan]

I want to find time difference between two events (duration some operation took) and plot a graph which shows how much time it took for each of the entity ... I gave some query mentioned below :

<base_search>|

| eval duration = duration_seconds + (60 * (duration_minutes + (60 * duration_hours)))
| fieldformat duration = tostring(duration, "duration")
| fieldformat duration_in_minutes = duration / 60

Now i got correct output in the form of a table , but with some extra fields I need first column (cls_id) and last column (duration_in_minutes) , Can someone help how can i get that?

I tried appending | table cls_id , duration_in_minutes , but that gives null value for "duration_in_minutes" field/column.

[cklunck]

The simplest way is probably to use the | fields command:

<base_search> 
| stuff
| more stuff
| fields cis_id duration_in_minutes

This tells Splunk to only keep these two fields. (You can also write it as | fields + cis_id duration_in_minutes if you prefer the operator being shown.)

[sravan]

I tried that as well , but i keep getting null/empty values for "duration_in_minutes" - same as how when i use below:  | table cls_id, duration_in_minutes. 

BTW when we use fields , will it stop processing all other intermediate fields and hence i dont see them?  

[cklunck]

I think you want to use eval instead of fieldformat, so it creates a new field. Fieldformat only creates a "view" into a field, which means we can't use it with the fields command later in the search. Sorry I didn't catch that the first time!

Something like this worked for me:

<base_search>|

| eval duration = duration_seconds + (60 * (duration_minutes + (60 * duration_hours)))
| fieldformat duration = tostring(duration, "duration")
| eval duration_in_minutes = duration / 60
| fields cls_id duration_in_minutes

Regarding your question about the fields command - yes, once you use fields to specify only the fields you wish to keep, then all the other fields are discarded from your results for the current search.

[sravan · Accepted solution]

fieldformat also didnt work for me.

Below one worked:

<base_search>|

| eval duration = duration_seconds + (60 * (duration_minutes + (60 * duration_hours)))
| fieldformat duration = tostring(duration, "duration")
| fieldformat duration_in_minutes = duration / 60

| fields "cls_id", "duration_in_minutes"

| stats sum(duration_in_minutes) by cls_id

[isoutamo]

One comment. When you are using fieldformat it doesn’t change the value of field, it just change the presentation of field on screen! This is useful if you want e.g. sort those fields numerically on screen by clicking column name. 
Based on that your fieldformat is not needed/used on previous SPL.