How to remove a column and replace it with another?

[taylorl]

Hi,

I wish to remove a column and replace it with one that has better information. Its a Dashboard recommended view.

[wpreston · Accepted solution]

Something like this?

source="wineventlog:*" NOT type=information | table _time Source Type

[taylorl]

Thank you so much! That's pointed me in the direction I needed.

[taylorl]

Search code listed below:

source="wineventlog:*" type NOT information

There is a type value that is indexed as I can search on it.

[strive]

Can you post your search here? Do you have Type field in your index OR evaluated field before you display as table.

Suppose if you have Type in your index, you can do this

Your Base Search...| table Time Source Type

Suppose if you are evaluating Type field then

Your Base Search ..| eval Type = YOUR EVAL EXPRESSION | table Time Source Type

If you provide more details then we can help you write the search as you need

[taylorl]

Sorry I thought I added an image but must have forgot to. In fact I just tried now and it says I need more karma to do so.

Well I will try explain it here this is how it currently looks

Time Source SourceType

10:00am / Application / Application

I want it to look like this:

Time Source Type

10:00am / Application / Warning

Minus the / of course I used them to seperate the columns

[linu1988]

more info please.

Use | table col1,col2,....

or

fields -col1 to remove column

or fields +col1 to add column