Dashboards & Visualizations

How to exclude _raw data column from "Statistics Table" panel?

yanivamram
Path Finder

Hi,

I've created a Statistics Table panel in a Dashboard.

My search query looks like:

sourcetype=my_sourcetype my_keyword |fields my_field1, my_field2 | sort +my_field1,+my_field2

But in the table I see also the raw data (_raw column).
Is there a way to exclude the _raw column?

Also, when I try to create a PDF report based on my Dashboard, all panels looks fine, but the Statistics Table panel doesn't contain the selected columns but only timestamp and _raw 😞

Thanks in advance,

Yaniv

Tags (4)
1 Solution

tom_frotscher
Builder

Hi,

i think what you should do is replace your fields command with the table command like that:

sourcetype=my_sourcetype my_keyword | table my_field1, my_field2 | sort +my_field1,+my_field2

View solution in original post

strive
Influencer

If you want to use fields command then see the second example in this link

http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchReference/fields

0 Karma

tom_frotscher
Builder

Hi,

i think what you should do is replace your fields command with the table command like that:

sourcetype=my_sourcetype my_keyword | table my_field1, my_field2 | sort +my_field1,+my_field2

yanivamram
Path Finder

Thanks a lot for the quick answer - now it works.
I am pretty new to Splunk.

Yaniv

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...