topic Re: How can I hide '_time' field from report table? in Splunk Search

How can I hide '_time' field from report table?

wanda619 — Thu, 22 Sep 2022 15:46:26 GMT

Re: How can I hide '_time' field from report table?

richgalloway — Thu, 22 Sep 2022 16:46:56 GMT

| fields - _time

Re: How can I hide '_time' field from report table?

lcguilfoil — Tue, 18 Mar 2025 14:43:47 GMT

Hi,

This removes the values of _time, but not the column header for me. Any ideas?

Re: How can I hide '_time' field from report table?

richgalloway — Tue, 18 Mar 2025 14:46:10 GMT

Please share your query so we can see how you're creating the column header. I suspect you need to remove "_time" from the table command.

Re: How can I hide '_time' field from report table?

lcguilfoil — Tue, 18 Mar 2025 14:49:38 GMT

I'm using a Classic Dashboard. This is my XML:

<event> <search> <query>index=index | fields - _time | table ApplicationName, ApplicationPath, LastRun</query> </search> <fields>ApplicationName, ApplicationPath, LastRun</fields> <option name="type">table</option> </event>

Re: How can I hide '_time' field from report table?

richgalloway — Tue, 18 Mar 2025 15:20:04 GMT

I was able to eliminate the _time column by changing the event tag to a table tag.

<table> <search> <query>index=_internal | fields - _time | table ApplicationName, ApplicationPath, LastRun</query> <earliest>$earliest$</earliest> <latest>$latest$</latest> </search> <option name="refresh.display">progressbar</option> <fields>["ApplicationName","ApplicationPath","LastRun"]</fields> </table>

Re: How can I hide '_time' field from report table?

lcguilfoil — Tue, 18 Mar 2025 16:47:47 GMT

Hi, I'd like to keep it an event and not a table.

Re: How can I hide '_time' field from report table?

PickleRick — Tue, 18 Mar 2025 17:15:45 GMT

An event does contain the _time field (even if empty). You cannot remove it from the visualization. The only thing you can do is hide it by declaring it invisible with CSS.