Hi,
I am having trouble getting the headers of the each column in trellis layout to change. It changes the names while it is updating the search and reverts back to dst_port name after search is complete. The table names are renamed just not the trellis headers.
index=netflow dst_port IN (21,22,23,445) | timechart span=12h count by dst_port | rename 21 as FTP, 22 as SSH, 23 as Telnet, 445 as SMB
Any help much appreciated.
index=netflow dst_port IN (21,22,23,445)
| eval dst_port=case(dst_port=21,"FTP",dst_port=22,"SSH",dst_port=23,"Telnet", dst_port=445,"SMB",true(),"other")
| timechart span=12h count by dst_port
the order is important.
index=netflow dst_port IN (21,22,23,445)
| eval dst_port=case(dst_port=21,"FTP",dst_port=22,"SSH",dst_port=23,"Telnet", dst_port=445,"SMB",true(),"other")
| timechart span=12h count by dst_port
the order is important.