How to rename search results obtained in stats?

[Nidd]

I have the following query created:

index=my_idx source=mySource | stats count by sourceTopic

Which gives me result like:

MY/EVENTS/EV1/TYPE1	| 16170
MY/EVENTS/EV1/TYPE2	| 3558
MY/EVENTS/EV1/TYPE3	| 419
MY/EVENTS/EV2/TYPE1	| 123391
MY/EVENTS/EV2/TYPE2	| 16734
MY/EVENTS/EV2/TYPE3	| 880

But I would need my result like:

TYPE1 EV1   | 16170
TYPE2 EV1   | 3558
TYPE3 EV1   | 419
TYPE1 EV2   | 123391
TYPE2 EV2   | 16734
TYPE3 EV2   | 880

How would I achieve this? How can I rename my values that I obtain in stats?

[Nidd]

Thanks much @richgalloway  !! It worked!

[richgalloway · Accepted solution]

In general, the replace command can be use to change values in stats results.

| stats count by sourceTopic
| replace "foo" with "bar" in sourceTopic

That probably won't do the job in this case, though.

We can use rex to extract the desired parts from the sourceTopic field and then rearrange them.

| rex field=sourceTopic "[^\/]+\/[^\/]+\/(?<f3>[^\/]+)\/(?<f4>.*)"
| eval sourceTopic = f4 . " " . f3
| table sourceTopic count