After I transpose my timechart, I'm getting 3 fields under my Column that I want to get rid of: _span, _spandays, and _time. It looks like this:
column | row 1 | row 2
_time | ### | ###
... | .... | ...
Is there a way to hide the rows or delete them?
I've tried using field - _span, but it doesn't work.
field - _span
Here's my search:
| timechart limit=1000 span=3month dc(user) by Customer
| fields - _span
| rename column as Customer, "row 1" as "3 Months Before", "row 2" as "Latest 3 Months"
Add this to the end:
| regex column!=("^_")
Or better yet add this before the transpose command:
| fields - _*
View solution in original post
you can do a |search column!=_* after transpose
or add |fields - _* before transpose
|fields - _*
Thanks, both work perfectly!