I have inserted a search inquiry which would remove the _raw data however the Column Headers still exist in the csv file.
I tried the query but does not remove these fields at all in the final report.
| fields - _raw, _sourcename, _sourcehost, _sourcecategory, _source
How do I remove them? Any thoughts?
Please sign in to leave a comment.