Change label after used transpose

[brian661]

I am using the follow search to generate a pie chart,
and I want toadd the score to the label on the pie chart.
say Math_total_score -> "Math 8 score".
But as my stats is not using by some_filed.
I find that I cannot use eval to change the label.
May someone help?

myLogSearch| stats count(eval(like(subject,"Maths"))) as Math_total_score, count(eval(like(subject, "English") AND attended == true )) as English_countable_score, count(eval(like(subject, "Phy") AND times >2 )) as Phy_countable_score| transpose 

[niketn]

Final eval should look like the following: (You can use cascaded replace command to find string patterns and replace with what you want in a column.

<Your Base Search>
| eval column=replace(replace(replace(column,"Math_total_score","Math"),"English_countable_score","English"),"Phy_countable_score","Phy")

[rjthibod]

You need to use a conditional eval.

myLogSearch
| stats count(eval(like(subject,"Maths"))) as Math_total_score, count(eval(like(subject, "English") AND attended == true )) as English_countable_score, count(eval(like(subject, "Phy") AND times >2 )) as Phy_countable_score
| transpose 
| eval column = if(column="Math_total_score", "Math", column)

[martin_mueller · Accepted solution]

Change the as Math_total_score in your stats to as the_label_you_want.

[martin_mueller]

Add this after the transpose: | eval column = column . " (" . 'row 1' . ")"

[brian661]

Thanks, it work perfectly!

[brian661]

really sorry that I forget to say that I want to add the count(eval(like(subject,"Maths"))) to the label....
I have updated the question