topic Re: how to change display name in chart in Dashboards & Visualizations

how to change display name in chart

avikc100 — Tue, 13 Aug 2024 20:48:37 GMT

this is my splunk query:

index="webmethods_prd" source="/apps/WebMethods/IntegrationServer/instances/default/logs/ExternalPACA.log" |eval timestamp=strftime(_time, "%F") | chart limit=30 count as count over source by timestamp

it is showing result as :

but I want to add a custom name to it, how should I do that?

Re: how to change display name in chart

gcusello — Tue, 13 Aug 2024 16:15:28 GMT

Hi @avikc100 ,

you have to use the eval command to change the source value.

so you could use the case statment having many values:

| eval source=case( source="*PACA.log", "Canada Pricing Call", source="*second_value.log" "Second value", source="*third_value.log" "Third value")

Ciao.

Giuseppe

Re: how to change display name in chart

avikc100 — Tue, 13 Aug 2024 20:49:30 GMT

I am getting blank value

index="webmethods_prd" host="USPGH-WMA2AISP*" source="/apps/WebMethods/IntegrationServer/instances/default/logs/ExternalPAEU.log" ("success" OR "fail*")| eval status = if(searchmatch("success"), "Success", "Error")|stats count by source,status| xyseries source status count| eval source=case( source="*PACA.log", "Canada Pricing Call")

Re: how to change display name in chart

avikc100 — Tue, 13 Aug 2024 20:49:08 GMT

I am getting blank value

Re: how to change display name in chart

gcusello — Wed, 14 Aug 2024 09:07:59 GMT

Hi @avikc100 ,

why did you used xyseries after stats?

please try:

index="webmethods_prd" host="USPGH-WMA2AISP*" source="/apps/WebMethods/IntegrationServer/instances/default/logs/ExternalPAEU.log" ("success" OR "fail*") | eval status = if(searchmatch("success"), "Success", "Error") | stats count by source status | eval source=if(source="*PAEU.log", "Canada Pricing Call","XXX")

Ciao.

Giuseppe