Splunk Search

How to remove _time field in search result?

Explorer

I have search string like this counter Write Copies | dedup counter | where Value < 50 | rename Value as values and configure the fields to show on the xml. I have not included the _time field but it automatically displays there. I also tried to use | fields - _time but it only removes the values but the column name is still there. Anyone experienced this?

Tags (4)

Champion

As long as you do not use a transforming command, your results will always be based on events, and events don't make sense without a timestamp. Therefore, the standard event view always shows the time column.

You might want to use table with the fields you are actually interested in, e.g.

... | table counter values

Explorer

thanks for the answer. But my problem in using table is it doesn't refresh/run the same way as events do. For example, if I have 3 panels namely red green and blue. If I will use the search string with table in it and put the condition as | where color = "green" yes it will put it the green panel but if I change the color to BLUE, the result in the green panel will still remain and just add the record to the blue panel. This doesn't happen when using events. If you can teach me how to use table in this kind of scenario then it would be a life saver. Thanks

0 Karma

Champion

I'm sorry, I don't understand what exactly you are doing with your panels. Are we talking about the panels on a dashboard? Please elaborate on what you are doing, maybe add a screenshot.

0 Karma

Esteemed Legend

I agree with @jeffland, I have absolutely no idea what you are meaning. You clarification just make it even worse.

0 Karma

Explorer

I mean I am using real time. When I use tables it doesn't update real time unlike the events. You will see the event option in the panel in between the magnifier icon and the paintbrush. There is an event option there and it updates every time the search runs. Statistics table can do this.

0 Karma

Champion

I've just tried this. A real time search (for simplicity) like this

index=_internal | head 3 | table host source

updates the table just fine.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!