How to rename columns in a chart that cam from nested json?

[thisissplunk]

I have a nested json element that gives back up to 8 field names. I table them like:

| table "Config.DiskBrandSize.*" 

Which has child elements like:

Barracuda: 100gb
Seagate: 50gb
Sandisk: 150gb

 I then sum them up:

| chart sum("Config.DiskBrandSize.*") 

and I get a table with columns like "sum(Config.DiskBrandSize{}.Sandisk)".

But I want to rename that to just something like "SandiskTotal" which is created from the column name + "Total", NOT do manual renames. I can't figure out how to do this with a foreach either.

[richgalloway · Accepted solution]

I know you said no manual renames, but the rename command is the one to use.   Like this:

| rename "Config.DiskBrandSize.*" as *Total

[thisissplunk]

Thanks, I didn't use rename but I used the same concept in the stats and chart commands.