Trellis column names keep reverting back

[Blackmagician]

Hi,

I am having trouble getting the headers of the each column in trellis layout to change. It changes the names while it is updating the search and reverts back to dst_port name after search is complete. The table names are renamed just not the trellis headers. 

index=netflow dst_port IN (21,22,23,445) | timechart span=12h count by dst_port | rename 21 as FTP, 22 as SSH, 23 as Telnet, 445 as SMB

Any help much appreciated.

[to4kawa · Accepted solution]

index=netflow dst_port IN (21,22,23,445) 
| eval dst_port=case(dst_port=21,"FTP",dst_port=22,"SSH",dst_port=23,"Telnet", dst_port=445,"SMB",true(),"other")
| timechart span=12h count by dst_port 

the order is important.