GEOSTATS Rename value in piechart

[wbolten]

Hi,

Is it possible to change the 'name' of the value in a pie chart displayed on a geostats map? The below example shows the piechart. The blue 1 indicate that there are 4 devices with that status. One device with status 14 and 1 with status 3. I have been trying the change the numbers into a readable status. 1=UP,3=WARNING,14=Critical but for some reason I don't seem to make it possible.

This is the SPL creating the worldmap

index="xxx" Splunk_Node=true
| stats latest(Latitude) as Latitude, latest(Longitude) as Longitude, latest(Node_Status) as Node_Status by NodeID
| geostats count(NodeID) by Node_Status latfield=Latitude longfield=Longitude

Been trying the below. Added this line and change the SPL from Node_Status to NodeStatus but then the map stays empty.

| eval NodeStatus = if(NodeStatus=1,"UP",if(NodeStatus=2,"DOWN",if(NodeStatus=3,"WARNING",if(NodeStatus=14,"CRITICAL",isnull)))) `comment("Change the status number to something readable")`

Someone any thoughts on this?

[richgalloway · Accepted solution]

This should do it.

index="xxx" Splunk_Node=true
| eval Node_Status = case (Node_Status=1, "UP", Node_Status=2, "DOWN", Node_Status=3, "WARNING", Node_Status=4, "CRITICAL", 1==1, "OTHER")
| stats latest(Latitude) as Latitude, latest(Longitude) as Longitude, latest(Node_Status) as Node_Status by NodeID
| geostats count(NodeID) by Node_Status latfield=Latitude longfield=Longitude

[wbolten]

Yep, that has done it. Many thanks. Did not occur to me to use case for this.

I corrected a typo in the CRITICAL part. The status number is 14 and not 4 but it works perfectly.