host=server| eval size = len(_raw) | eval DSize = round(size/1024,2)| chart count(counter),sum(DSize) as "Daily indexed in KB" over source
Is the query I have. It creates 3 colums as I want but the count(counters) is the middle column header and I want to change that to "Number of events" The rest of the query works just fine.
host=server | eval size = len(_raw) | eval DSize = round(size/1024,2)| chart count(counter) as "number of events" , sum(DSize) as "Daily indexed in KB" over source
Had the rename in the wrong part of the query.