How do you change the legend value

[BunnyHop]

Outside of renaming(aliasing) the actual field, can you also rename the entire content of the history for charting? (i.e. instead of count(field/alias), rename it to Total Count of FIELD).

[ftk · Accepted solution]

Yes you can, see below:

your search | chart count(foo) as "Total Count of FOO" by bar