Dashboards & Visualizations

How to change graph legend labels for real time?

jliaw
Explorer

I have the same situation as the link below.
https://answers.splunk.com/answers/423906/how-to-change-the-graph-legend-labels-for-a-trendl.html

But I have many labels to rename which not able to rename one by one. May I know is there any easier way to rename the graph legend labels?

alt text

I would like the serial ID in graph is replace by the location name. The respective location name is just listed in a table is not clear enough for overall view.

Tags (1)
0 Karma

niketn
Legend

@jliaw, please add more details on what you currently have i.e. your SPL. Dynamic Field names(sample) and what logic you want for renaming them. Sample table of the output that you currently have will also help us assist you better. You can mask/anonymize any sensitive data before posting the same here.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

jliaw
Explorer

Hi Niketnilay, I have updated my question with image attached for better understanding.

0 Karma

niketn
Legend

Can you also provide the current search?

DO you need just the Location Name or field4 and LocationName?

You can try the following to show only LocationName and count:

<yourCurrentSearch>
| table LocationName count

Or in case you need both field4 and LocationName

<yourCurrentSearch>
| eval LocationName=field4." (".LocationName.")"
| table LocationName count
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...