I have search string like this
counter Write Copies | dedup counter | where Value < 50 | rename Value as values and configure the fields to show on the xml. I have not included the _time field but it automatically displays there. I also tried to use
| fields - _time but it only removes the values but the column name is still there. Anyone experienced this?
As long as you do not use a transforming command, your results will always be based on events, and events don't make sense without a timestamp. Therefore, the standard event view always shows the time column.
You might want to use
table with the fields you are actually interested in, e.g.
... | table counter values
thanks for the answer. But my problem in using table is it doesn't refresh/run the same way as events do. For example, if I have 3 panels namely red green and blue. If I will use the search string with table in it and put the condition as
| where color = "green" yes it will put it the green panel but if I change the color to BLUE, the result in the green panel will still remain and just add the record to the blue panel. This doesn't happen when using events. If you can teach me how to use table in this kind of scenario then it would be a life saver. Thanks
I mean I am using real time. When I use tables it doesn't update real time unlike the events. You will see the event option in the panel in between the magnifier icon and the paintbrush. There is an event option there and it updates every time the search runs. Statistics table can do this.