Dashboards & Visualizations

How to exclude _raw data column from "Statistics Table" panel?

yanivamram
Path Finder

Hi,

I've created a Statistics Table panel in a Dashboard.

My search query looks like:

sourcetype=my_sourcetype my_keyword |fields my_field1, my_field2 | sort +my_field1,+my_field2

But in the table I see also the raw data (_raw column).
Is there a way to exclude the _raw column?

Also, when I try to create a PDF report based on my Dashboard, all panels looks fine, but the Statistics Table panel doesn't contain the selected columns but only timestamp and _raw 😞

Thanks in advance,

Yaniv

Tags (4)
1 Solution

tom_frotscher
Builder

Hi,

i think what you should do is replace your fields command with the table command like that:

sourcetype=my_sourcetype my_keyword | table my_field1, my_field2 | sort +my_field1,+my_field2

View solution in original post

strive
Influencer

If you want to use fields command then see the second example in this link

http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchReference/fields

0 Karma

tom_frotscher
Builder

Hi,

i think what you should do is replace your fields command with the table command like that:

sourcetype=my_sourcetype my_keyword | table my_field1, my_field2 | sort +my_field1,+my_field2

yanivamram
Path Finder

Thanks a lot for the quick answer - now it works.
I am pretty new to Splunk.

Yaniv

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...