Dashboards & Visualizations

Change label after used transpose

New Member

I am using the follow search to generate a pie chart,
and I want toadd the score to the label on the pie chart.
say Math_total_score -> "Math 8 score".
But as my stats is not using by some_filed.
I find that I cannot use eval to change the label.
May someone help?

myLogSearch| stats count(eval(like(subject,"Maths"))) as Math_total_score, count(eval(like(subject, "English") AND attended == true )) as English_countable_score, count(eval(like(subject, "Phy") AND times >2 )) as Phy_countable_score| transpose 
Tags (3)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Change the as Math_total_score in your stats to as the_label_you_want.

View solution in original post

0 Karma

Legend

Final eval should look like the following: (You can use cascaded replace command to find string patterns and replace with what you want in a column.

<Your Base Search>
| eval column=replace(replace(replace(column,"Math_total_score","Math"),"English_countable_score","English"),"Phy_countable_score","Phy")
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Champion

You need to use a conditional eval.

myLogSearch
| stats count(eval(like(subject,"Maths"))) as Math_total_score, count(eval(like(subject, "English") AND attended == true )) as English_countable_score, count(eval(like(subject, "Phy") AND times >2 )) as Phy_countable_score
| transpose 
| eval column = if(column="Math_total_score", "Math", column)
0 Karma

SplunkTrust
SplunkTrust

Change the as Math_total_score in your stats to as the_label_you_want.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Add this after the transpose: | eval column = column . " (" . 'row 1' . ")"

0 Karma

New Member

Thanks, it work perfectly!

0 Karma

New Member

really sorry that I forget to say that I want to add the count(eval(like(subject,"Maths"))) to the label....
I have updated the question

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!