How to change the graph legend labels for a trendline in Splunk?

[umichguy]

I have the following search displaying a trendline as part of visualization:

index=mail sourcetype=abc_mail action=4 OR action=2 OR action=0 | timechart count by action

Here, '4' means 'allowed', '0' means 'denied' and '2' means 'quarantined'. Currently, the graph legend just shows '0' '2' and '4' as labels to the trendlines. I want to write 'allowed' 'denied' and 'quarantined' there instead so that it makes more sense to someone who doesn't know what these codes mean.

How can I do this in Splunk?

[woodcock · Accepted solution]

Typically this is done with a lookup but for so few values, you can do this:

index=mail sourcetype=abc_mail action=4 OR action=2 OR action=0
| eval action=case((action=0), "Denied",
                   (action=2), "Quarantined",
                   (action=4), "Allowed",
                       true(), "IMPOSSIBLE!")
| timechart count by action

[unnigec]

Thanks, I had a similar scenario and this worked.

[pal4life]

I am trying to convert my month no to Month name - 1 2 3 to Jan Feb Mar but it does not seem to work with just the rename

[umichguy]

I just tried it. And it seems to now label the legend as '0' '2' and '4' (as earlier) and then adds another label 'action' on there. It does not really resolve the codes to text.

[umichguy]

OK. I modified it and now it works. I needed to do the 'eval' first and then 'timechart' after. If you modify the answer above accordingly, I will accept it as correct 🙂

[woodcock]

Right, I switched it around, I forgot that timchart converts values to field names. You can also do this:

index=mail sourcetype=abc_mail action=4 OR action=2 OR action=0
| timechart count by action
| rename 0 AS Denied 2 AS Quarantined 4 AS Allowed

[pal4life]

I am trying to convert my month no to Month name - 1 2 3 to Jan Feb Mar but it does not seem to work with just the rename