How to edit my search to change the output of certain strings in results?

[SecureIA]

Hi Helpful People,

I have a table which tells me perfectly well who is logged in to systems. My results show the words "Opened" and "Closed". I wish for them to say "In" or "Out" instead. Is there anyway that I can achieve this so that my results are more readable. My search is as follows:

host=?? NOT host=?? NOT host=?? NOT username=?? NOT username= ?? NOT username= ?? NOT username=?? "Session opened" OR "Session closed" | sort username time | chart latest(lstate) over username by host.

[somesoni2 · Accepted solution]

You can use replace command for that. http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/Replace

host=?? NOT host=?? NOT host=?? NOT username=?? NOT username= ?? NOT username= ?? NOT username=?? "Session opened" OR "Session closed" | sort username time | chart latest(lstate) over username by host | replace "Opened" with "In" "Closed" with "Out" in *

[SecureIA]

Thank you so much!! I remember doing this a while back but had totally forgotten. Thanks for reminding me