Dashboards & Visualizations

How to change graph legend labels for real time?

jliaw
Explorer

I have the same situation as the link below.
https://answers.splunk.com/answers/423906/how-to-change-the-graph-legend-labels-for-a-trendl.html

But I have many labels to rename which not able to rename one by one. May I know is there any easier way to rename the graph legend labels?

alt text

I would like the serial ID in graph is replace by the location name. The respective location name is just listed in a table is not clear enough for overall view.

Tags (1)
0 Karma

niketn
Legend

@jliaw, please add more details on what you currently have i.e. your SPL. Dynamic Field names(sample) and what logic you want for renaming them. Sample table of the output that you currently have will also help us assist you better. You can mask/anonymize any sensitive data before posting the same here.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

jliaw
Explorer

Hi Niketnilay, I have updated my question with image attached for better understanding.

0 Karma

niketn
Legend

Can you also provide the current search?

DO you need just the Location Name or field4 and LocationName?

You can try the following to show only LocationName and count:

<yourCurrentSearch>
| table LocationName count

Or in case you need both field4 and LocationName

<yourCurrentSearch>
| eval LocationName=field4." (".LocationName.")"
| table LocationName count
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...