Kind of a weird question but I have a Single Value panel that currently displays the (Search Area value "CCS") I still want it to display CCS but I want it to say EMAIL. So visually I want the words changed but the search behind it working the same, how would I go about doing this? I included the XML of my panel because I feel like it may not be completely related to search alone.
I tried using rename "CCS" AS "EMAIL" BY "CCS", but that did not work.
<panel>
<title>CCS/Email</title>
<single>
<title>Status:</title>
<search>
<query>|status.csv | search Area="CCS"|eval value=case(Severity="low",1,Severity="severe",3,Severity="elevated",2) | sort by - value | head 1|rangemap field=value severe=3-3 elevated=2-2 low=1-1</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="drilldown">none</option>
</single>
</panel>
I don't know if this is actually possible, but if it is would be interested! Still very new to Splunk!
