https://community.splunk.com/t5/Splunk-Search/How-to-replace-description-into-timechart-results/m-p/501351#M195113 <P>Grate, it is working fine.</P> <P>My mistake was:</P> <P>index="_introspection" component ="hostwide" <BR /> | lookup indexers indexer as splunk_server OUTPUT <STRONG><EM>indexer as splunk_server</EM></STRONG><BR /> | timechart max(data.mem.mem_used) as Current by <STRONG><EM>splunk_server</EM></STRONG></P> Wed, 30 Sep 2020 04:00:47 GMT wieslaww 2020-09-30T04:00:47Z https://community.splunk.com/t5/Splunk-Search/How-to-replace-description-into-timechart-results/m-p/501349#M195111 <P>Splunk Enterprise 7.2.0</P> <P>I have my query:</P> <BLOCKQUOTE> <P>index="_itrospection" component ="hostwide" | timechart max(data.mem.mem_used) as Current by splunk_server</P> </BLOCKQUOTE> <P>In the legend I see the <EM>splunk_server</EM> descriptions based on <EM>hostnames</EM>.</P> <P>I created lookup <EM>indexers.csv</EM>:<BR /> indexer,site<BR /> hostname1,Site-1<BR /> hostname2,Site-2</P> <P>How can I use lookup to replace <EM>splunk_server</EM> fields by lookup field <EM>site</EM>?</P> Wed, 30 Sep 2020 04:00:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-replace-description-into-timechart-results/m-p/501349#M195111 wieslaww 2020-09-30T04:00:42Z https://community.splunk.com/t5/Splunk-Search/How-to-replace-description-into-timechart-results/m-p/501350#M195112 <P>Hi @wieslaww do you have 1 to 1 mapping between host name and Site or not?</P> <P>If so, create a <A href="https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Aboutlookupsandfieldactions#Lookup_definitions">Lookup Definition</A> for indexers.csv and then change the query as following:</P> <PRE><CODE>index="_introspection" component ="hostwide" | lookup indexers indexer as splunk_server OUTPUT site | timechart max(data.mem.mem_used) as Current by site </CODE></PRE> Wed, 05 Feb 2020 13:14:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-replace-description-into-timechart-results/m-p/501350#M195112 niketn 2020-02-05T13:14:46Z https://community.splunk.com/t5/Splunk-Search/How-to-replace-description-into-timechart-results/m-p/501351#M195113 <P>Grate, it is working fine.</P> <P>My mistake was:</P> <P>index="_introspection" component ="hostwide" <BR /> | lookup indexers indexer as splunk_server OUTPUT <STRONG><EM>indexer as splunk_server</EM></STRONG><BR /> | timechart max(data.mem.mem_used) as Current by <STRONG><EM>splunk_server</EM></STRONG></P> Wed, 30 Sep 2020 04:00:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-replace-description-into-timechart-results/m-p/501351#M195113 wieslaww 2020-09-30T04:00:47Z