https://community.splunk.com/t5/Splunk-Search/How-to-rename-multiple-fields-in-a-chart/m-p/224747#M66218 <P>If you use column-split options with charting commands like chart/timechart (<CODE>over field by field</CODE> for <CODE>chart</CODE> and <CODE>by field</CODE> for <CODE>timechart</CODE>), it'll creates columns which include the values of the by clause field. </P> <P>E.g. <CODE>..|chart count over field1 by field2</CODE> will give columns <CODE>field1, field2value1 field2value2....</CODE>.</P> <P>If you're using multiple aggregation, Splunk can't differentiate them with just the field1value, so it appends the aggregation column names as well.</P> <P>E.g. <CODE>..|chart count dc(field3) over field1 by field2</CODE> will give columns <CODE>field1, count:field2value1 count:field2value2... dc(field3):field2value1, dc(field3):field2value2....</CODE>.</P> <P>I would rename aggregation field within chart command itself to give a proper name so that chart generates series with proper names. E.g. <CODE>..|chart count dc(field3) as label over field1 by field2</CODE> will give columns <CODE>field1, count:field2value1 count:field2value2... label:field2value1, label:field2value2....</CODE>.</P> <P>What is the field name that you expect to come? Consider using stats instead of chart.</P> Thu, 29 Sep 2016 15:47:47 GMT somesoni2 2016-09-29T15:47:47Z https://community.splunk.com/t5/Splunk-Search/How-to-rename-multiple-fields-in-a-chart/m-p/224744#M66215 <P>When i run the following query, my legend has the values as <CODE>values(fieldname)</CODE>: </P> <PRE><CODE>index=main source=daily_report sourcetype=ironport_stats | chart values(malicious_url),values(detected_virus) over insert_date by server </CODE></PRE> <P>How would I rename the values fields so they show up as what I want in the legend of the graph?</P> <P>Thanks in advance! </P> Thu, 29 Sep 2016 04:36:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-rename-multiple-fields-in-a-chart/m-p/224744#M66215 zhatsispgx 2016-09-29T04:36:27Z https://community.splunk.com/t5/Splunk-Search/How-to-rename-multiple-fields-in-a-chart/m-p/224745#M66216 <P>Try:<BR /> index=main source=daily_report sourcetype=ironport_stats | chart values(malicious_url),values(detected_virus) over insert_date by server | rename values(malicious_url) as malicious_url values(detected_virus) as detected_virus</P> Tue, 29 Sep 2020 11:14:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-rename-multiple-fields-in-a-chart/m-p/224745#M66216 mydog8it 2020-09-29T11:14:33Z https://community.splunk.com/t5/Splunk-Search/How-to-rename-multiple-fields-in-a-chart/m-p/224746#M66217 <P>this didn't work. the legend still shows: </P> <P><CODE>values(malicious_url): mail1</CODE><BR /> <CODE>values(malicious_url): mail2</CODE></P> Thu, 29 Sep 2016 15:37:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-rename-multiple-fields-in-a-chart/m-p/224746#M66217 zhatsispgx 2016-09-29T15:37:44Z https://community.splunk.com/t5/Splunk-Search/How-to-rename-multiple-fields-in-a-chart/m-p/224747#M66218 <P>If you use column-split options with charting commands like chart/timechart (<CODE>over field by field</CODE> for <CODE>chart</CODE> and <CODE>by field</CODE> for <CODE>timechart</CODE>), it'll creates columns which include the values of the by clause field. </P> <P>E.g. <CODE>..|chart count over field1 by field2</CODE> will give columns <CODE>field1, field2value1 field2value2....</CODE>.</P> <P>If you're using multiple aggregation, Splunk can't differentiate them with just the field1value, so it appends the aggregation column names as well.</P> <P>E.g. <CODE>..|chart count dc(field3) over field1 by field2</CODE> will give columns <CODE>field1, count:field2value1 count:field2value2... dc(field3):field2value1, dc(field3):field2value2....</CODE>.</P> <P>I would rename aggregation field within chart command itself to give a proper name so that chart generates series with proper names. E.g. <CODE>..|chart count dc(field3) as label over field1 by field2</CODE> will give columns <CODE>field1, count:field2value1 count:field2value2... label:field2value1, label:field2value2....</CODE>.</P> <P>What is the field name that you expect to come? Consider using stats instead of chart.</P> Thu, 29 Sep 2016 15:47:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-rename-multiple-fields-in-a-chart/m-p/224747#M66218 somesoni2 2016-09-29T15:47:47Z