I have a search using Timewrap that compares today against last week for the same week day. I'm having issues with renaming the field "1week_before" so it displays as "Last Tuesday". The search fails with
Error in 'rename' command: Usage: rename [old_name AS/TO/-> new_name]+
any time I try adding a space so the closest I've been able to get is "Last_Tuesday". Is there a way to do this?
earliest="-w@w" latest="+w@w" index="_internal" sourcetype="scheduler"
| timechart span=10m count
| timewrap w
| where strftime(_time,"%A") == strftime(now(), "%A")
| rename latest_week as Today
| rename 1week_before as [| stats count | eval tmp=strftime(now(), "%A") | eval str="Last_".tmp | return $str]
There are multiple options
earliest="-w@w" latest="+w@w" index="_internal" sourcetype="scheduler"
| timechart span=10m count
| timewrap w
| where strftime(_time,"%A") == strftime(now(), "%A")
| rename latest_week as Today
| rename 1week_before as [| stats count | eval tmp=strftime(now(), "%A") | eval str="\"Last ".tmp."\"" | return $str]
OR
earliest="-w@w" latest="+w@w" index="_internal" sourcetype="scheduler"
| timechart span=10m count
| timewrap w
| where strftime(_time,"%A") == strftime(now(), "%A")
| rename latest_week as Today
| eval t=strftime(_time,"%A")
| eval "Last {t}"='1week_before' | fields - 1week_before,t
There are multiple options
earliest="-w@w" latest="+w@w" index="_internal" sourcetype="scheduler"
| timechart span=10m count
| timewrap w
| where strftime(_time,"%A") == strftime(now(), "%A")
| rename latest_week as Today
| rename 1week_before as [| stats count | eval tmp=strftime(now(), "%A") | eval str="\"Last ".tmp."\"" | return $str]
OR
earliest="-w@w" latest="+w@w" index="_internal" sourcetype="scheduler"
| timechart span=10m count
| timewrap w
| where strftime(_time,"%A") == strftime(now(), "%A")
| rename latest_week as Today
| eval t=strftime(_time,"%A")
| eval "Last {t}"='1week_before' | fields - 1week_before,t
Both of your solutions worked perfectly, thank you!