I have a search that gives me a number of columns in the stats field.
max(col1) max(col2) ...
Can I replace the brackets in the column/field names with underscore?
max_col1_ max_col2_ ...
I have looked at replace but that seems to work on the values in the field as opposed to the fieldname.
I am looking for a generic way to do it as apposed to go through each field.
You can use the rename command with wildcard.
your current search giving column names max(col1) max(col2)... etc | rename max(*) as max_*
@MuS's solution is what the most optimum and recommended one (get the correct column name while generating columns).
in your stats command you can provide names for the result:
your base search here | stats max(col1) AS max_col1 max(col2) AS max_col2
Hope this helps ...
tks Mus, sorry should have said, was looking for a more generic way. I am familliar with that method.
I reckon you should rephrase your question in this case; so we understand what you're looking for and also provide your search string.