Getting Data In
Highlighted

suppressing underscore prefixed columns from report

Contributor

I have a report:
blah, blah, blah
| stats count as NbrSaves, dc(UserId) as DistinctUserIds
by datenumericyear, datenumericmonth, dateyear, datemonth, datemday, datehour, datenumericminute
| sort 0 + datenumericyear, datenumericmonth, datemday, datehour, datenumericminute
| rename dateyear as Year, datemonth as Month, datemday as Day, datehour as Hour, datenumericminute as Minute
| outputcsv AffinityPlanSaveRate.csv

It outputs too many items for the screen and is instead sent to a report, but datenumericyear and datenumericmonth (which are computed fields just used for ordering purposes) also appear in the saved file, although not on the display. I thought the underscore would suppress them from both. How can I also suppress them from the generated report?

0 Karma
Highlighted

Re: suppressing underscore prefixed columns from report

Splunk Employee
Splunk Employee
0 Karma
Highlighted

Re: suppressing underscore prefixed columns from report

Contributor

Ah, didn't know about the + and - signs. Thanks much.

0 Karma