index =* "log" earliest =@d-4h latest=@d+8h | rex "
Want to rename column name(today) into event date. Kindly support.
@jayavasge ,
index = "log" earliest =@d-4h latest=@d+8h | rex "(?\w)<" | dedup ticketId | stats count as "event date"
Give this a burl: index = "log" earliest =@d-4h latest=@d+8h | rex "(?\w)<" | dedup ticketId | stats count as today| rename today as "event date"
Good luck!