topic How to change the column name after timechart output in Splunk Search

How to change the column name after timechart output

ravir_jbp — Thu, 02 Nov 2023 17:22:13 GMT

I am created below query to get the hourly report of certain tasks. I go the final timechart values for four different "connectiontype" below. But I like to rename the column name to something else.

Re: How to change the column name after timechart output

ITWhisperer — Thu, 02 Nov 2023 18:57:35 GMT

| rename 'old field name' as "new field name"

or, change the field values before the timechart

| eval connectionType=case(connectionType=="old field value 1","new field value 1", connectionType=="old field value 2", "new field value 2", true(), connectionType)