How to rename column name when using "chart count over by" command

[saurabhsumangat]

i written a query and need to change the output name of one the table column

....| chart count over sourceIP by Status

in this i get status result as

sourceIP Open Closed
xx.xx.xx.xx 2 5

How to change the name "Open and Closed" to "Pending and Completed" respectively

[vnravikumar · Accepted solution]

Hi

Try like

....|eval Status=case(Status=="Open","Pending",Status=="Closed","Completed") |  chart count over sourceIP by Status