Splunk Search

How to remove _time field in search result?

josefa123
Explorer

I have search string like this counter Write Copies | dedup counter | where Value < 50 | rename Value as values and configure the fields to show on the xml. I have not included the _time field but it automatically displays there. I also tried to use | fields - _time but it only removes the values but the column name is still there. Anyone experienced this?

Tags (4)

jeffland
SplunkTrust
SplunkTrust

As long as you do not use a transforming command, your results will always be based on events, and events don't make sense without a timestamp. Therefore, the standard event view always shows the time column.

You might want to use table with the fields you are actually interested in, e.g.

... | table counter values

josefa123
Explorer

thanks for the answer. But my problem in using table is it doesn't refresh/run the same way as events do. For example, if I have 3 panels namely red green and blue. If I will use the search string with table in it and put the condition as | where color = "green" yes it will put it the green panel but if I change the color to BLUE, the result in the green panel will still remain and just add the record to the blue panel. This doesn't happen when using events. If you can teach me how to use table in this kind of scenario then it would be a life saver. Thanks

0 Karma

jeffland
SplunkTrust
SplunkTrust

I'm sorry, I don't understand what exactly you are doing with your panels. Are we talking about the panels on a dashboard? Please elaborate on what you are doing, maybe add a screenshot.

0 Karma

woodcock
Esteemed Legend

I agree with @jeffland, I have absolutely no idea what you are meaning. You clarification just make it even worse.

0 Karma

josefa123
Explorer

I mean I am using real time. When I use tables it doesn't update real time unlike the events. You will see the event option in the panel in between the magnifier icon and the paintbrush. There is an event option there and it updates every time the search runs. Statistics table can do this.

0 Karma

jeffland
SplunkTrust
SplunkTrust

I've just tried this. A real time search (for simplicity) like this

index=_internal | head 3 | table host source

updates the table just fine.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...