i written a query and need to change the output name of one the table column
....| chart count over sourceIP by Status
in this i get status result as
sourceIP Open Closed
xx.xx.xx.xx 2 5
How to change the name "Open and Closed" to "Pending and Completed" respectively
Hi
Try like
....|eval Status=case(Status=="Open","Pending",Status=="Closed","Completed") | chart count over sourceIP by Status
Hi
Try like
....|eval Status=case(Status=="Open","Pending",Status=="Closed","Completed") | chart count over sourceIP by Status