Dashboards & Visualizations

How to change graph legend labels for real time?

jliaw
Explorer

I have the same situation as the link below.
https://answers.splunk.com/answers/423906/how-to-change-the-graph-legend-labels-for-a-trendl.html

But I have many labels to rename which not able to rename one by one. May I know is there any easier way to rename the graph legend labels?

alt text

I would like the serial ID in graph is replace by the location name. The respective location name is just listed in a table is not clear enough for overall view.

Tags (1)
0 Karma

niketnilay
Legend

@jliaw, please add more details on what you currently have i.e. your SPL. Dynamic Field names(sample) and what logic you want for renaming them. Sample table of the output that you currently have will also help us assist you better. You can mask/anonymize any sensitive data before posting the same here.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

jliaw
Explorer

Hi Niketnilay, I have updated my question with image attached for better understanding.

0 Karma

niketnilay
Legend

Can you also provide the current search?

DO you need just the Location Name or field4 and LocationName?

You can try the following to show only LocationName and count:

<yourCurrentSearch>
| table LocationName count

Or in case you need both field4 and LocationName

<yourCurrentSearch>
| eval LocationName=field4." (".LocationName.")"
| table LocationName count
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!