Dashboards & Visualizations

Change label after used transpose

brian661
New Member

I am using the follow search to generate a pie chart,
and I want toadd the score to the label on the pie chart.
say Math_total_score -> "Math 8 score".
But as my stats is not using by some_filed.
I find that I cannot use eval to change the label.
May someone help?

myLogSearch| stats count(eval(like(subject,"Maths"))) as Math_total_score, count(eval(like(subject, "English") AND attended == true )) as English_countable_score, count(eval(like(subject, "Phy") AND times >2 )) as Phy_countable_score| transpose 
Tags (3)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Change the as Math_total_score in your stats to as the_label_you_want.

View solution in original post

0 Karma

niketnilay
Legend

Final eval should look like the following: (You can use cascaded replace command to find string patterns and replace with what you want in a column.

<Your Base Search>
| eval column=replace(replace(replace(column,"Math_total_score","Math"),"English_countable_score","English"),"Phy_countable_score","Phy")
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

rjthibod
Champion

You need to use a conditional eval.

myLogSearch
| stats count(eval(like(subject,"Maths"))) as Math_total_score, count(eval(like(subject, "English") AND attended == true )) as English_countable_score, count(eval(like(subject, "Phy") AND times >2 )) as Phy_countable_score
| transpose 
| eval column = if(column="Math_total_score", "Math", column)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Change the as Math_total_score in your stats to as the_label_you_want.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Add this after the transpose: | eval column = column . " (" . 'row 1' . ")"

0 Karma

brian661
New Member

Thanks, it work perfectly!

0 Karma

brian661
New Member

really sorry that I forget to say that I want to add the count(eval(like(subject,"Maths"))) to the label....
I have updated the question

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...