topic Re: How to remove _time field in search result? in Splunk Search

How to remove _time field in search result?

josefa123 — Tue, 14 Jul 2015 06:20:38 GMT

I have search string like this counter Write Copies | dedup counter | where Value < 50 | rename Value as values and configure the fields to show on the xml. I have not included the _time field but it automatically displays there. I also tried to use | fields - _time but it only removes the values but the column name is still there. Anyone experienced this?

Re: How to remove _time field in search result?

jeffland — Tue, 14 Jul 2015 06:28:58 GMT

As long as you do not use a transforming command, your results will always be based on events, and events don't make sense without a timestamp. Therefore, the standard event view always shows the time column.

You might want to use table with the fields you are actually interested in, e.g.

... | table counter values

Re: How to remove _time field in search result?

josefa123 — Tue, 14 Jul 2015 06:33:44 GMT

thanks for the answer. But my problem in using table is it doesn't refresh/run the same way as events do. For example, if I have 3 panels namely red green and blue. If I will use the search string with table in it and put the condition as | where color = "green" yes it will put it the green panel but if I change the color to BLUE, the result in the green panel will still remain and just add the record to the blue panel. This doesn't happen when using events. If you can teach me how to use table in this kind of scenario then it would be a life saver. Thanks

Re: How to remove _time field in search result?

jeffland — Tue, 14 Jul 2015 06:48:59 GMT

I'm sorry, I don't understand what exactly you are doing with your panels. Are we talking about the panels on a dashboard? Please elaborate on what you are doing, maybe add a screenshot.

Re: How to remove _time field in search result?

woodcock — Tue, 14 Jul 2015 15:09:26 GMT

I agree with @jeffland, I have absolutely no idea what you are meaning. You clarification just make it even worse.

Re: How to remove _time field in search result?

josefa123 — Wed, 15 Jul 2015 07:10:21 GMT

I mean I am using real time. When I use tables it doesn't update real time unlike the events. You will see the event option in the panel in between the magnifier icon and the paintbrush. There is an event option there and it updates every time the search runs. Statistics table can do this.

Re: How to remove _time field in search result?

jeffland — Wed, 15 Jul 2015 07:20:38 GMT

I've just tried this. A real time search (for simplicity) like this

index=_internal | head 3 | table host source

updates the table just fine.