topic Transpose and Timechart giving unnecessary fields in Splunk Search

Transpose and Timechart giving unnecessary fields

jofermin — Wed, 02 Aug 2017 16:28:54 GMT

After I transpose my timechart, I'm getting 3 fields under my Column that I want to get rid of: _span, _spandays, and _time. It looks like this:

column | row 1 | row 2
_time | ### | ###
... | .... | ...
_span |
_spandays|

Is there a way to hide the rows or delete them?

I've tried using field - _span, but it doesn't work.

Here's my search:

| timechart limit=1000 span=3month dc(user) by Customer | transpose | fields - _span | rename column as Customer, "row 1" as "3 Months Before", "row 2" as "Latest 3 Months"

Re: Transpose and Timechart giving unnecessary fields

woodcock — Wed, 02 Aug 2017 16:36:47 GMT

Add this to the end:

| regex column!=("^_")

Or better yet add this before the transpose command:

| fields - _*

Re: Transpose and Timechart giving unnecessary fields

cmerriman — Wed, 02 Aug 2017 16:39:05 GMT

you can do a |search column!=_* after transpose
or add |fields - _* before transpose

Re: Transpose and Timechart giving unnecessary fields

jofermin — Wed, 02 Aug 2017 16:59:43 GMT

Thanks, both work perfectly!