topic Re: how can i rename the values in piechart in Dashboards & Visualizations

how can i rename the values in piechart

navd — Wed, 31 Jan 2018 16:30:57 GMT

I have piechart created and i want to rename the values that i have for all the pie slices .

Re: how can i rename the values in piechart

kamlesh_vaghela — Wed, 31 Jan 2018 16:35:44 GMT

HI @navd,

The labels are coming for events so you have to change before chart or stats command.

Can you please share your sample search & sample data (old label and new label)?

Thanks

Re: how can i rename the values in piechart

niketn — Wed, 31 Jan 2018 16:42:38 GMT

@navd, is this different from your previous question https://answers.splunk.com/answers/614546/display-the-values-on-pie-slice-in-pie-chart.html ?

Re: how can i rename the values in piechart

navd — Wed, 31 Jan 2018 16:42:42 GMT

I have the statistics like this :

etc_state count

compute;good count(6424) 6424
server;notify count(64) 64

So,here I want to rename compute;good as Good and server;notify as notify

Re: how can i rename the values in piechart

navd — Wed, 31 Jan 2018 16:43:53 GMT

yes ,now I wanted to rename

Re: how can i rename the values in piechart

493669 — Wed, 31 Jan 2018 16:52:52 GMT

You can try case statement:

<base search>|eval etc_state=case(etc_state=="compute;good" ,"good",etc_state=="server;notify","notify",1==1,"")

Re: how can i rename the values in piechart

niketn — Wed, 31 Jan 2018 16:56:44 GMT

@navd, if the field name for pie chart label is field, you can apply the following replace() command with regex match to retain only text after semicolon.

 <YourCurrentSearch>
| eval <yourFieldName>=replace(<yourFieldName>,"([^;]+);(.*)","\2")

Following is the run anywhere search for reference:

| makeresults
| eval field="compute;good count(6424)", value=6424
| append [| makeresults
| eval field="server;notify count(64)", value=64]
| fields - _time
| eval field=replace(field,"([^;]+);(.*)","\2")

Re: how can i rename the values in piechart

niketn — Wed, 31 Jan 2018 16:58:14 GMT

Ok, refer to answer below for this question. Also please accept the answer to your previous question if one of the suggested answers has worked out for you.