https://community.splunk.com/t5/Splunk-Dev/Column-Chart-Legend-always-as-count/m-p/302802#M3902 <P>@wuming79, with your current query, protocol names are on x-axis. x-axis labels are not being shown in the visualization because there are too many of those you can try x-axis Label Rotation to -90° using Edit Format for the Column Chart. You can also try using Pie Chart as visualization for your data.</P> <P>Having said that you try the following <CODE>transpose</CODE> command so that count takes x-axis and Protocol becomes legend.</P> <PRE><CODE>&lt;YourBaseSearch&gt; | stats count by Protocol | transpose 0 header_field="Protocol" column_name="Protocol" </CODE></PRE> Mon, 28 Aug 2017 09:09:14 GMT niketn 2017-08-28T09:09:14Z https://community.splunk.com/t5/Splunk-Dev/Column-Chart-Legend-always-as-count/m-p/302801#M3901 <P>Hi,</P> <P>I'm trying to plot a bar chart to show the number of protocol scan in a network but my chart always shows my legend as count instead of protocol. How should I search so that the bar chart will show legend as many protocol and my column chart will see different colours for each different protocol?</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/3410i2628E150B428A42A/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Mon, 28 Aug 2017 07:52:31 GMT https://community.splunk.com/t5/Splunk-Dev/Column-Chart-Legend-always-as-count/m-p/302801#M3901 wuming79 2017-08-28T07:52:31Z https://community.splunk.com/t5/Splunk-Dev/Column-Chart-Legend-always-as-count/m-p/302802#M3902 <P>@wuming79, with your current query, protocol names are on x-axis. x-axis labels are not being shown in the visualization because there are too many of those you can try x-axis Label Rotation to -90° using Edit Format for the Column Chart. You can also try using Pie Chart as visualization for your data.</P> <P>Having said that you try the following <CODE>transpose</CODE> command so that count takes x-axis and Protocol becomes legend.</P> <PRE><CODE>&lt;YourBaseSearch&gt; | stats count by Protocol | transpose 0 header_field="Protocol" column_name="Protocol" </CODE></PRE> Mon, 28 Aug 2017 09:09:14 GMT https://community.splunk.com/t5/Splunk-Dev/Column-Chart-Legend-always-as-count/m-p/302802#M3902 niketn 2017-08-28T09:09:14Z