Kind of a weird question but I have a Single Value panel that currently displays the (Search Area value "CCS") I still want it to display CCS but I want it to say EMAIL. So visually I want the words changed but the search behind it working the same, how would I go about doing this? I included the XML of my panel because I feel like it may not be completely related to search alone.
I tried using rename "CCS" AS "EMAIL" BY "CCS", but that did not work.
CCS/Email Status: |status.csv | search Area="CCS"|eval value=case(Severity="low",1,Severity="severe",3,Severity="elevated",2) | sort by - value | head 1|rangemap field=value severe=3-3 elevated=2-2 low=1-1 0
I don't know if this is actually possible, but if it is would be interested! Still very new to Splunk!
↧