I have a search
...| timechart span=1h sum(kpi1) as Name1 by LABEL
This gives a 2 column output with _time
and LABEL1
as there headers.
How Can I control the value LABEL1
of the header for the colum to be something else?
I have tried doing ...| strcat LABEL "-ALT" LABEL_ALT | timechart span=1h sum(kpi1) as Name1 by LABEL_ALT
but this seem to divide the values in the `LABEL1
by 2 which is not what I want, maybe it is something to do with the data format.
this works, if LABEL1
is the column header
...| timechart span=1h sum(kpi1) as Name1 by LABEL | rename LABEL1 as test123
this works, if LABEL1
is the column header
...| timechart span=1h sum(kpi1) as Name1 by LABEL | rename LABEL1 as test123