How to remove timestamp from NRQL results (tabular format)

Is there a way where we can skip showing the “timestamp” field in the NRQL result of tabular format. If not possible, can we reorder the fields as per our select statement, so that I can keep this “timestamp” field at the end.

3 Likes

Hi, @nagendrakunduri: What query are you using to get the data? If you don’t request the timestamp in your SELECT statement, it should not appear in the result.

Hello Phil,
Its the data from custom events & we don’t query the timestamp, its just the two fields that were mentioned there.
If we select the Table format, it just results with timestamp that too on the first place.

Thanks,

OK, yes, I am able to reproduce this behavior. I don’t know of any way to prevent the timestamp from appearing, but you can list it last in the SELECT clause, and it will appear in the right-most column:

SELECT account_name, policy_name, condition_name, details, timestamp FROM Alert 

1 Like

Yes, this works to keep the field at the end of the table but if we have any other field (say “venue” then “timestamp” comes before & sends “venue” to the last.
We need a way to skip this field from getting displayed. Reason is, if we have the chart for limited space, we just use necessary fields to display & this extra field “timestamp” comes into picture & disturbs the view by providing a slider at the bottom of the chart.

Hi @nagendrakunduri

This is the only way to remove the timestamp from the focus of your query results. If you do add a new attribute of Venue in your query, you can just add that before the timestamp again - taking Phil’s query as an example:

SELECT account_name, policy_name, condition_name, details, venue, timestamp FROM Alert 

This will push the timestamp to the far right side of the results. Which yes, introduces a scroll bar, but, the primary view of the results table will show up in view, not requiring a scroll.

@nagendrakunduri, perhaps try wrapping the column name in the uniques() method?

SELECT uniques(<COLUMN>) FROM <TABLE> WHERE <CONDITION>
4 Likes

Hi @clyde.dsouza! Thanks for sharing your suggestion on the community! It’s always appreciated!

1 Like

Appreciate the suggestion.
Still this remains a limitation of NRQL tabular queries.
The solution is ugly for multiple columns, where you need to do uniques(col1), ..., uniques(colN) as a comma inside uniques() would be interpreted as preceding the limit parameter.

Hi @lucfd

Is your request relating to timestamp or how uniques works? I would be interested to know what you are trying to achive.

Hi @GlenOFoghlu, I am looking for the proper way to not have Timestamp returned, not a workaround.

Hey @lucfd,

Thank you for the clarification. The team is still reviewing this and will get a response out to you shortly. We appreciate your patience as we continue to provide support.

1 Like

Hey @michaelfrederick, wondering if there’s been any update to this as I’m currently facing the same issue as @lucfd?

Hi, @Gurteg.Singh: I am not aware of any change. Currently the options are to SELECT individual attributes and list timestamp last, or wrap the attribute names in the uniques() function.