How do I rename fields in my Splunk search result set?

[pawnalmighty]

index=xxx earliest=-7d@d latest=@d
( sourcetype="FirstSourceType" ResponsePayLoad="*xxx*" ActivityStep="rs" (ResponseStatus!=500 OR ResponseStatus!=400) )
OR
( sourcetype="SecondSourceType" OperationName=CSRequestProcessor.post ActivityStep="rs" ResponseStatus=0)
| eval txn_id=if(transaction_id LIKE "[%]", substr(transaction_id, 2, 36) , transaction_id) | chart sum(Duration) over txn_id by sourcetype

What I get is a table with three columns :

txn_id ..... FirstSourceType .... SecondSourceType

Is it possible to rename FirstSourceType & SecondSourceType to "Total Time Taken" & "Total time taken by zzz" respectively?

I tried rename command but couldn't get it to work:

index=xxx earliest=-7d@d latest=@d
( sourcetype="FirstSourceType" ResponsePayLoad="*xxx*" ActivityStep="rs" (ResponseStatus!=500 OR ResponseStatus!=400) ) | rename sourcetype to "Total Time Taken"
OR
( sourcetype="SecondSourceType" OperationName=CSRequestProcessor.post ActivityStep="rs" ResponseStatus=0)  | rename sourcetype to ""Total time taken by zzz"
| eval txn_id=if(transaction_id LIKE "[%]", substr(transaction_id, 2, 36) , transaction_id) | chart sum(Duration) over txn_id by sourcetype

But I got the error:

Error in 'rename' command: Usage: rename [old_name AS/TO/-> new_name]+

[fdi01]

try like :

... | rename  FirstSourceType as  "Total Time Taken" , SecondSourceType as "Total time taken by zzz"  |...

you can try like this in your case :

 index=xxx earliest=-7d@d latest=@d
( sourcetype="FirstSourceType" ResponsePayLoad="*xxx*" ActivityStep="rs" (ResponseStatus!=500 OR ResponseStatus!=400) )
OR
( sourcetype="SecondSourceType" OperationName=CSRequestProcessor.post ActivityStep="rs" ResponseStatus=0) 
| eval txn_id=if(transaction_id LIKE "[%]", substr(transaction_id, 2, 36) , transaction_id) | chart sum(Duration) over txn_id by sourcetype |replace  FirstSourceType with   "Total Time Taken" in sourcetype |replace  SecondSourceType with   "Total time taken by zzz" in sourcetype 

[asimagu]

you can try eval

eval "Total Time Taken"=sourcetype

and then you will need to get rid of the unwanted fields | fields - sourcetype