Formatting the report / table

[RashmiGowda]

Hello

M trying to generate the report by using the below query:-

index="xyz" source="abc" | timechart span=1h count as Transactions by host | eval Time=strftime(_time, "%H:%M") | convert timeformat="%m-%d-%y" ctime(_time) as Date

My result is in the below format : _time, Date, Time, Host

In result m getting the default _time column also. how to eliminate this _time column from the result..??

Also i need the report format as Date, Time, Host1 but the generated report file(csv) in mail has _time, Host Date Time..

how to format this..?/
Please help me out..??

[somesoni2 · Accepted solution]

Try this

index="xyz" source="abc" | timechart span=1h count as Transactions by host | eval Time=strftime(_time, "%H:%M") | convert timeformat="%m-%d-%y" ctime(_time) as Date | fields - _time | table Date, Time, *