I am using the query as below and visualizing it in a line chart.  There is date field coming on the line chart and I want to remove it through XML without removing time field? Can someone guide me .  (I was able to remove it in query using field format command but it was not super helpful as I was not able to see visualization.)  Also, I was able to remove the hover through this article - Solved: How to disable mouse hover on bar chart in XML - Splunk Community But not the date.  This one is very close to what I want to do, but didn't solve my case on the line chart.  Solved: How to delete the date category on a visualization... - Splunk Community Query for reference index=xyz sourctype=abc earliest = -60m@m latest = @m |eval ReportKey="Today" |append [search index=index=xyz sourctype=abc earliest = -60m@m-1w latest = @m-1w |eval ReportKey="LastWeek" | eval _time=relative_time(_time, "+1w")] |append [search index=index=xyz sourctype=abc earliest = -60m@m-2w latest = @m-2w |eval ReportKey="TwoWeeksBefore" | eval _time=relative_time(_time, "+2w")] |append [search index=index=xyz sourctype=abc earliest = -60m@m-3w latest = @m-3w |eval ReportKey="ThreeWeeksBefore" | eval _time=relative_time(_time, "+3w")] |timechart span = 1m count(index) as Volume by Reportkey   ... View more

HI I have a query like below. Can i use something else than join  index=hello sourcetype="logs A" source="C:\\football\ab*"  OR source="C:\\Tennis\cd*" OR source="C:\\Cricket\eb*"  | rex (something) |eval (something) | join type=left [search sourcetype = "logs B" source="C:\\football\ab*"  OR source="C:\\Tennis\cd*" OR source="C:\\Cricket\eb*"  |rex (something) |eval (somthing)] table  ... View more