I'm trying to use a timechart function to display folder names and their sizes over time. When I do this, the string "VALUE" is prepended to each of the table header values.
My search:
| timechart span=2h max(DirectorySize) by FolderName
The data is displayed correctly but the series values have the string "VALUE" prepended to them. Example:
_time OTHER VALUE_folder1 VALUE_folder2 VALUE_folder3
Also note that my folder names start with an underscore. I'm thinking that may be triggering this behavior.
Any help would be appreciated.
This is intended behaviour.
By default, the field values of FolderName
become the new field names. However, field names beginning with an underscore denote internal fields that are hidden from view. To avoid this unintentionally hiding all your folder names, VALUE
is prepended to your field names.
You can change the outcome like this:
... | timechart ... by FolderName | rename VALUE_* as whatever*
That'll replace all the VALUE_
prefixes with whatever
in field names beginning with that prefix.
This is intended behaviour.
By default, the field values of FolderName
become the new field names. However, field names beginning with an underscore denote internal fields that are hidden from view. To avoid this unintentionally hiding all your folder names, VALUE
is prepended to your field names.
You can change the outcome like this:
... | timechart ... by FolderName | rename VALUE_* as whatever*
That'll replace all the VALUE_
prefixes with whatever
in field names beginning with that prefix.
That works - very easy solution. Thanks.