How can I hide '_time' field from report table?

[richgalloway · Accepted solution]

| fields - _time

[lcguilfoil]

Hi,

This removes the values of _time, but not the column header for me. Any ideas?

[richgalloway]

Please share your query so we can see how you're creating the column header.  I suspect you need to remove "_time" from the table command.

[lcguilfoil]

I'm using a Classic Dashboard. This is my XML:

<event>
	<search>
		<query>index=index 
		| fields - _time
		| table ApplicationName, ApplicationPath, LastRun</query>
	</search>
	<fields>ApplicationName, ApplicationPath, LastRun</fields>
	<option name="type">table</option>
</event>

[richgalloway]

I was able to eliminate the _time column by changing the event tag to a table tag.

      <table>
        <search>
          <query>index=_internal
		| fields - _time
		| table ApplicationName, ApplicationPath, LastRun</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
        <fields>["ApplicationName","ApplicationPath","LastRun"]</fields>
      </table>

[lcguilfoil]

Hi, I'd like to keep it an event and not a table.

[PickleRick]

An event does contain the _time field (even if empty). You cannot remove it from the visualization. The only thing you can do is hide it by declaring it invisible with CSS.