| makeresults | eval _raw="buyer=1 open_cases=3 buyer=1 open_cases=2 buyer=1 open_cases=5 buyer=2 open_cases=6 buyer=2 open_cases=1" | multikv noheader=t | fields _raw | rename COMMENT as "this is sample, from here, the logic" | kv | bin span=1d _time | stats last(open_cases) as last_cases by buyer _time | stats sum(last_cases) as sum_open_cases by _time try after COMMENT ... View more

Just remove it with the fields command at the end of your search. ... | fields - Pings That should remove "Pings" but leave all else. ... View more