After I transpose my timechart, I'm getting 3 fields under my Column that I want to get rid of: _span, _spandays, and _time. It looks like this:
column | row 1 | row 2
_time | ### | ###
... | .... | ...
_span |
_spandays|
Is there a way to hide the rows or delete them?
I've tried using field - _span
, but it doesn't work.
Here's my search:
| timechart limit=1000 span=3month dc(user) by Customer
| transpose
| fields - _span
| rename column as Customer, "row 1" as "3 Months Before", "row 2" as "Latest 3 Months"
Add this to the end:
| regex column!=("^_")
Or better yet add this before the transpose command:
| fields - _*
you can do a |search column!=_*
after transpose
or add |fields - _*
before transpose
Add this to the end:
| regex column!=("^_")
Or better yet add this before the transpose command:
| fields - _*
Thanks, both work perfectly!