Can I Rename the Variable on a Chart for Predict Command?

[andrewkenth]

Just as it says..

Can I rename the variable on a chart for predict command? Instead of count and prediction(count) I'd like Actual and Estimated.

Thanks!

[martin_mueller · Accepted solution]

You can rename any field at any time: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/rename

[martin_mueller]

It should work inside the box as well, something like this:

... | timechart count as Actual | predict Actual as Estimated

That's basically a rename wrapped into the reporting command.

[andrewkenth]

Not sure why I didn't think of this.. I was looking for an option in predict instead of thinking outside the box! This works:

| rename count as Actual | rename prediction(count) as Estimated