Hi.
I have the following query
BASE QUERY earliest=-7d latest=now | bucket _time span=7d | stats count as events by source _time |chart sum(events) by source, _time
this query gives me the column source and, in this case, 2 columns (that if i change earliest and span, become N columns).
the deal is that those columns are names by the time, in some strange format (1471557600 and 1472162400).
so, in this case, I have 3 columns: source - 1471557600 - 1472162400.
I need to dynamically rename the columns by position, without knowing their names at run time.
Is there some command like: rename the 2nd column = "this week" ans the 3rd column = "last week" ?
Thank you
Try this
BASE QUERY earliest=-14d latest=now | eval when=if(_time>relative_time(now(), "-7d@d"), "Current Week, "Prev Week") | stats count as events by source when |chart sum(events) by source, when
Try this
BASE QUERY earliest=-14d latest=now | eval when=if(_time>relative_time(now(), "-7d@d"), "Current Week, "Prev Week") | stats count as events by source when |chart sum(events) by source, when
I works!
Thanks a lot!
Have you considered using the timewrap command?
Thanks!
I didn't use the timewrap for solving this issue but I will use it for other issues.