I am guessing you want the column name to be renamed for the result of the search?
If that is the case you can pipe your search to
| rename columnname AS "yournew_name"
if you want to change the name of the field before doing calculations with the new name, you should use the eval command
| eval newname=oldname
@asimagu Thanks for your reply but it didnt answer my query. I dont know the column name. it is created at run time.
| rename columnname AS "yournewname". i want "yournewname" to be like "COLUMNNAME" - upper case of whatever is present in the column
If you want ALL fieldnames to be upper case, then do this at the end...
| streamstats count as recno | untable recno fieldname fieldvalue | eval fieldname = upper(fieldname) | xyseries recno fieldname fieldvalue | fields - recno
Be aware that the above code will turn multivalue fields to single value fields as if they had been
nomved. The following code will protect an mv field called "foo".
| streamstats count as recno | eval foo = mvjoin(foo,"!!!!") | untable recno fieldname fieldvalue | eval fieldname = upper(fieldname) | xyseries recno fieldname fieldvalue | eval FOO = split(FOO,"!!!!") | fields - recno