Hi.
I have the following query
BASE QUERY earliest=-7d latest=now | bucket _time span=7d | stats count as events by source _time |chart sum(events) by source, _time
this query gives me the column source and, in this case, 2 columns (that if i change earliest and span, become N columns).
the deal is that those columns are names by the time, in some strange format (1471557600 and 1472162400).
so, in this case, I have 3 columns: source - 1471557600 - 1472162400.
I need to dynamically rename the columns by position, without knowing their names at run time.
Is there some command like: rename the 2nd column = "this week" ans the 3rd column = "last week" ?
Thank you
↧