Splunk Search

Can I Rename the Variable on a Chart for Predict Command?

andrewkenth
Communicator

Just as it says..

Can I rename the variable on a chart for predict command? Instead of count and prediction(count) I'd like Actual and Estimated.

Thanks!

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust
0 Karma

martin_mueller
SplunkTrust
SplunkTrust
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

It should work inside the box as well, something like this:

... | timechart count as Actual | predict Actual as Estimated

That's basically a rename wrapped into the reporting command.

0 Karma

andrewkenth
Communicator

Not sure why I didn't think of this.. I was looking for an option in predict instead of thinking outside the box! This works:

| rename count as Actual | rename prediction(count) as Estimated

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...