Timechart prepends "VALUE' to table header values

[trodenbaugh]

I'm trying to use a timechart function to display folder names and their sizes over time. When I do this, the string "VALUE" is prepended to each of the table header values.

My search:

| timechart span=2h max(DirectorySize) by FolderName

The data is displayed correctly but the series values have the string "VALUE" prepended to them. Example:
_time OTHER VALUE_folder1 VALUE_folder2 VALUE_folder3

Also note that my folder names start with an underscore. I'm thinking that may be triggering this behavior.

Any help would be appreciated.

[martin_mueller · Accepted solution]

This is intended behaviour.

By default, the field values of FolderName become the new field names. However, field names beginning with an underscore denote internal fields that are hidden from view. To avoid this unintentionally hiding all your folder names, VALUE is prepended to your field names.

You can change the outcome like this:

... | timechart ... by FolderName | rename VALUE_* as whatever*

That'll replace all the VALUE_ prefixes with whatever in field names beginning with that prefix.

[trodenbaugh]

That works - very easy solution. Thanks.