How can I change the values in the legend for a timechart? I use: index=indexone sourcetype=sourceone | timechart count by X usenull=0 span=1h |timewrap 1day
Some of the results look like: X_22days_before. I want to have just the X.
