I want to rename row value by data case. (It is line chart)
The line chart row name changed by token $value$
if value is "iron" -> row must rename as "metal" -> and graph line become "black"
if value is "steak" -> row must rename as "food". -> and graph line become "red"
so I wrote the code like this, but it's not work at all.
<search>
<query>
...
|eval dt = case("$value$" == "iron", "metal", 1=1, "food")
|rename "row 1" as dt
...
</query>
</search>
<option name="charting.fieldColors">{"metal": 0xffffff, "food" : 0xFF0000}</option>
How could I solve this problem?
<search>
<query>
...
|eval dt = case("$value$" == "iron", "metal", 1=1, "food")
|eval {dt}='row 1'
...
</query>
</search>
<option name="charting.fieldColors">{"metal": 0xffffff, "food" : 0xFF0000}</option>
<search>
<query>
...
|eval dt = case("$value$" == "iron", "metal", 1=1, "food")
|eval {dt}='row 1'
...
</query>
</search>
<option name="charting.fieldColors">{"metal": 0xffffff, "food" : 0xFF0000}</option>
I added this code under my code, but it show three rows 😢
row 1, "metal", "dt"
How could I solve this?
I added this line
<search>
<query>
...
|sort total_time
|transpose
|eval dt = case("$value$" == "iron", "metal", 1=1, "food")
|eval {dt}='row 1'
...
</query>
</search>
<option name="charting.fieldColors">{"metal": 0xffffff, "food" : 0xFF0000}</option>
| fields - dt "row 1"
OHHH There is something wrong my code.
It work!
Thank you for your help!!!😀