Here is my query; I'm trying not to have the "Total_Datapoints" column show up in the table since it has the same value for every row.
report=hw_use_by_jobs orig_host="myhost" | chart p50(PercentProcessorTime_max) as "p50 CPU", stdev(PercentProcessorTime_max) as "CPU stdev", count as DataPoints over ConcurrentTasks | eventstats sum(DataPoints) as Total_DataPoints | eval "Percent of Time"=100*DataPoints/Total_DataPoints
I've experimented with calculating the Total_Datapoints value before sending the results to the table, but this has not worked out and I'm not even sure if that's the right overall approach.
Pretty easy 🙂
At the very end:
| fields <list of fields you want to be displayed (no commas)>
This solution is not going to work for stats where column names are dynamic, for example stats table produced by timechart. I would rather use ....|fields -columnnameto_exclude
BTW, the question is a duplicate of https://answers.splunk.com/answers/48466/remove-column-name-from-table-result.html