https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-rename-column-name-when-using-quot-chart-count-over-by/m-p/432310#M5637 <P>Hi</P> <P>Try like</P> <PRE><CODE>....|eval Status=case(Status=="Open","Pending",Status=="Closed","Completed") | chart count over sourceIP by Status </CODE></PRE> Fri, 26 Apr 2019 08:19:52 GMT vnravikumar 2019-04-26T08:19:52Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-rename-column-name-when-using-quot-chart-count-over-by/m-p/432309#M5636 <P>i written a query and need to change the output name of one the table column</P> <P>....| chart count over sourceIP by Status</P> <P>in this i get status result as </P> <P>sourceIP Open Closed<BR /> xx.xx.xx.xx 2 5</P> <P>How to change the name "Open and Closed" to "Pending and Completed" respectively</P> Fri, 26 Apr 2019 08:13:06 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-rename-column-name-when-using-quot-chart-count-over-by/m-p/432309#M5636 saurabhsumangat 2019-04-26T08:13:06Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-rename-column-name-when-using-quot-chart-count-over-by/m-p/432310#M5637 <P>Hi</P> <P>Try like</P> <PRE><CODE>....|eval Status=case(Status=="Open","Pending",Status=="Closed","Completed") | chart count over sourceIP by Status </CODE></PRE> Fri, 26 Apr 2019 08:19:52 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-rename-column-name-when-using-quot-chart-count-over-by/m-p/432310#M5637 vnravikumar 2019-04-26T08:19:52Z