https://community.splunk.com/t5/Splunk-Enterprise/Hi-I-want-to-ask-quot-Can-I-change-the-number-212-42-and-181-to/m-p/413276#M1337 <P>Hi, can you send through the search from the search bar that made the graph in your original post? (If it is in a dashboard, when you mouseover it, you can select the magnifying lens icon to open the underlying search)</P> Sun, 01 Jul 2018 23:31:23 GMT datasearchninja 2018-07-01T23:31:23Z https://community.splunk.com/t5/Splunk-Enterprise/Hi-I-want-to-ask-quot-Can-I-change-the-number-212-42-and-181-to/m-p/413272#M1333 <P>Hi I want to ask if there is anyway for me to change the number to the words.<BR /> For example I want to the number 212 is display as maxis.</P> Fri, 29 Jun 2018 02:38:32 GMT https://community.splunk.com/t5/Splunk-Enterprise/Hi-I-want-to-ask-quot-Can-I-change-the-number-212-42-and-181-to/m-p/413272#M1333 khairilfirza 2018-06-29T02:38:32Z https://community.splunk.com/t5/Splunk-Enterprise/Hi-I-want-to-ask-quot-Can-I-change-the-number-212-42-and-181-to/m-p/413273#M1334 <P>Yes you can do this with a case statement, so assuming your graph is currently produced like this, where the numbers are in afield call 'line':</P> <PRE><CODE>| stats count by line </CODE></PRE> <P>You could then do this, defaulting back to the number if you haven't set a value:</P> <PRE><CODE>| eval text=case(line=="181","text_for_181",line=="211","text_for_211",line=="212","maxis",line==42","text_for_42",1==1,line) | stats count by text </CODE></PRE> Fri, 29 Jun 2018 02:59:00 GMT https://community.splunk.com/t5/Splunk-Enterprise/Hi-I-want-to-ask-quot-Can-I-change-the-number-212-42-and-181-to/m-p/413273#M1334 datasearchninja 2018-06-29T02:59:00Z https://community.splunk.com/t5/Splunk-Enterprise/Hi-I-want-to-ask-quot-Can-I-change-the-number-212-42-and-181-to/m-p/413274#M1335 <P>Thanks Colin for a good answer.</P> <P>Unfortunately I'm so beginner in splunk. Can you show me where I should put your code? </P> Fri, 29 Jun 2018 03:14:26 GMT https://community.splunk.com/t5/Splunk-Enterprise/Hi-I-want-to-ask-quot-Can-I-change-the-number-212-42-and-181-to/m-p/413274#M1335 khairilfirza 2018-06-29T03:14:26Z https://community.splunk.com/t5/Splunk-Enterprise/Hi-I-want-to-ask-quot-Can-I-change-the-number-212-42-and-181-to/m-p/413275#M1336 <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/5289i1BBEABE0FCDD67E6/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Fri, 29 Jun 2018 03:18:22 GMT https://community.splunk.com/t5/Splunk-Enterprise/Hi-I-want-to-ask-quot-Can-I-change-the-number-212-42-and-181-to/m-p/413275#M1336 khairilfirza 2018-06-29T03:18:22Z https://community.splunk.com/t5/Splunk-Enterprise/Hi-I-want-to-ask-quot-Can-I-change-the-number-212-42-and-181-to/m-p/413276#M1337 <P>Hi, can you send through the search from the search bar that made the graph in your original post? (If it is in a dashboard, when you mouseover it, you can select the magnifying lens icon to open the underlying search)</P> Sun, 01 Jul 2018 23:31:23 GMT https://community.splunk.com/t5/Splunk-Enterprise/Hi-I-want-to-ask-quot-Can-I-change-the-number-212-42-and-181-to/m-p/413276#M1337 datasearchninja 2018-07-01T23:31:23Z