Create a Legend based upon another table

[pwoodring]

Hello gurus. I have a panel with a STATS COUNT chart where the y-axis is numeric value. What we would like is a legend where the description of the y-axis number is given. I know that LOOKUP is involved but I am not sure how to send it to the legend. It cannot be a static table because there are thousands of message Descriptions and we only want to see the descriptions for detail in the chart. Thanks in advance.

[pwoodring · Accepted solution]

Since the Legend functionality is limited i just cheated and added a table directly below to chart.

[woodcock]

Go ahead and click Accept on your answer to close the question.

[pwoodring]

I would like one of the following outcomes:

1. Hover over the Bar and see the description but have the y-axis still show the message ID
2. Have a legend at the bottom of the chart translating the message ID to the description.

I have the search below with some changes for privacy reasons. Thanks for helping.

host=SERVERNAME source="audit.log"| rex "\"(?.+?)\",\"(?.+?)\",\"(?.+?)\",\"(?.+?)\",\"(?.+?)\",\"(?.+?)\"" | eval is_match=case("$accountoption$" == "X" AND !LIKE(AccountName, "%X%"),1, "$accountoption$" == "Y" AND LIKE(AccountName, "%Y%"),1, "$accountoption$" == "Z" AND !LIKE(AccountName, "%Z%"),1,1==1,0) | where is_match = 1 | stats count by MessageID | lookup statusmessage.csv MessageNum AS MessageID OUTPUT MessageDesc AS MessageID

[woodcock]

I assume you are doing something like:

... | stats count BY code

So you need to add this to it:

| lookup YourLookupDefinitionHere code OUTPUT description AS code

[chrisyounger]

This is quite easy to do but you will need to provide some code showing what you are already doing so we can help you better 🙂