topic Create a Legend based upon another table in Dashboards & Visualizations

Create a Legend based upon another table

pwoodring — Fri, 08 Feb 2019 17:28:28 GMT

Hello gurus. I have a panel with a STATS COUNT chart where the y-axis is numeric value. What we would like is a legend where the description of the y-axis number is given. I know that LOOKUP is involved but I am not sure how to send it to the legend. It cannot be a static table because there are thousands of message Descriptions and we only want to see the descriptions for detail in the chart. Thanks in advance.

Re: Create a Legend based upon another table

chrisyounger — Fri, 08 Feb 2019 19:34:16 GMT

This is quite easy to do but you will need to provide some code showing what you are already doing so we can help you better 🙂

Re: Create a Legend based upon another table

woodcock — Fri, 08 Feb 2019 19:44:18 GMT

I assume you are doing something like:

... | stats count BY code

So you need to add this to it:

| lookup YourLookupDefinitionHere code OUTPUT description AS code

Re: Create a Legend based upon another table

pwoodring — Tue, 29 Sep 2020 23:08:08 GMT

I would like one of the following outcomes:

1. Hover over the Bar and see the description but have the y-axis still show the message ID
2. Have a legend at the bottom of the chart translating the message ID to the description.

I have the search below with some changes for privacy reasons. Thanks for helping.

host=SERVERNAME source="audit.log"| rex "\"(?.+?)\",\"(?.+?)\",\"(?.+?)\",\"(?.+?)\",\"(?.+?)\",\"(?.+?)\"" | eval is_match=case("$accountoption$" == "X" AND !LIKE(AccountName, "%X%"),1, "$accountoption$" == "Y" AND LIKE(AccountName, "%Y%"),1, "$accountoption$" == "Z" AND !LIKE(AccountName, "%Z%"),1,1==1,0) | where is_match = 1 | stats count by MessageID | lookup statusmessage.csv MessageNum AS MessageID OUTPUT MessageDesc AS MessageID

Re: Create a Legend based upon another table

pwoodring — Wed, 13 Feb 2019 15:15:04 GMT

Since the Legend functionality is limited i just cheated and added a table directly below to chart.

Re: Create a Legend based upon another table

woodcock — Wed, 13 Feb 2019 17:42:04 GMT

Go ahead and click Accept on your answer to close the question.