Just as it says..
Can I rename the variable on a chart for predict command? Instead of count and prediction(count) I'd like Actual and Estimated.
Thanks!
You can rename any field at any time: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/rename
View solution in original post
It should work inside the box as well, something like this:
... | timechart count as Actual | predict Actual as Estimated
That's basically a rename wrapped into the reporting command.
Not sure why I didn't think of this.. I was looking for an option in predict instead of thinking outside the box! This works:
| rename count as Actual | rename prediction(count) as Estimated
