How to change graph legend labels for real time?

[jliaw]

I have the same situation as the link below.
https://answers.splunk.com/answers/423906/how-to-change-the-graph-legend-labels-for-a-trendl.html

But I have many labels to rename which not able to rename one by one. May I know is there any easier way to rename the graph legend labels?

I would like the serial ID in graph is replace by the location name. The respective location name is just listed in a table is not clear enough for overall view.

[niketn]

@jliaw, please add more details on what you currently have i.e. your SPL. Dynamic Field names(sample) and what logic you want for renaming them. Sample table of the output that you currently have will also help us assist you better. You can mask/anonymize any sensitive data before posting the same here.

[jliaw]

Hi Niketnilay, I have updated my question with image attached for better understanding.

[niketn]

Can you also provide the current search?

DO you need just the Location Name or field4 and LocationName?

You can try the following to show only LocationName and count:

<yourCurrentSearch>
| table LocationName count

Or in case you need both field4 and LocationName

<yourCurrentSearch>
| eval LocationName=field4." (".LocationName.")"
| table LocationName count