Splunk Search

Transpose and Timechart giving unnecessary fields

jofermin
Explorer

After I transpose my timechart, I'm getting 3 fields under my Column that I want to get rid of: _span, _spandays, and _time. It looks like this:

column | row 1 | row 2
_time | ### | ###
... | .... | ...
_span |
_spandays|

Is there a way to hide the rows or delete them?

I've tried using field - _span, but it doesn't work.

Here's my search:

| timechart limit=1000 span=3month dc(user) by Customer
| transpose
| fields - _span
| rename column as Customer, "row 1" as "3 Months Before", "row 2" as "Latest 3 Months"

0 Karma
1 Solution

woodcock
Esteemed Legend

Add this to the end:

| regex column!=("^_")

Or better yet add this before the transpose command:

| fields - _*

View solution in original post

cmerriman
Super Champion

you can do a |search column!=_* after transpose
or add |fields - _* before transpose

woodcock
Esteemed Legend

Add this to the end:

| regex column!=("^_")

Or better yet add this before the transpose command:

| fields - _*

View solution in original post

jofermin
Explorer

Thanks, both work perfectly!

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!