The search command that I have used is:
| chart list(field1) as A list(field2) as B by name month
The result I am getting is something like this
Name A : JAN A : FEB A : MAR B : JAN B : FEB B : MAR
abc
xyz
Desired result:
NAME JAN : A JAN : B FEB : A FEB : B MAR : A MAR : B
abc
xyz
I know the reason why I am getting the result but is there any way to change the names like the desired one?
Thanks in advance.
hey try this
<your_base_query> | chart list(field1) as A list(field2) as B over name by month | rename A:* as *:A B:* as *:B
let me know if this helps!
hey try this
<your_base_query> | chart list(field1) as A list(field2) as B over name by month | rename A:* as *:A B:* as *:B
let me know if this helps!
Thank you,it worked.
Try to use rename
[your_search] | rename "A:*" as "*:A", "B:*" as "*:B"
Thanks for the answer