- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- How to modify timewrap legend?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi ! I am trying to modify the legend generated by the timewrap command. I saw that we could slightly change it with the parameter "series" but it's not really giving me what I want.
Let's say I want to have a sum of prices from this request :
index=sandbox earliest=-13d | timechart sum(prices) as "Sum of the prices" span=d | timewrap 1w series=relative
The legend will be Sum of the prices_1week_before and Sum of the prices_latest_week . I would like to have something like Sum of the prices for the week before and Sum of the prices for the latest week .
How can I get this ? Thanks !
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
One option would be to use series="exact" option to provide format for time series i.e.
<yourCurrentSearch>
| timewrap 1w series=exact time_format="Sum of the prices for %Y-%U week"
If you intend to use series="relative", you can use rename command to change series name as required (relative option will generate some generic names as per the series name in the timechart.
<yourCurrentSearch>
| timewrap 1w series=relative
| rename "Sum of the prices_latest_week" as "Sum of the prices latest week",
"Sum of the prices_1week_before" as "Sum of the prices the week before",
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
One option would be to use series="exact" option to provide format for time series i.e.
<yourCurrentSearch>
| timewrap 1w series=exact time_format="Sum of the prices for %Y-%U week"
If you intend to use series="relative", you can use rename command to change series name as required (relative option will generate some generic names as per the series name in the timechart.
<yourCurrentSearch>
| timewrap 1w series=relative
| rename "Sum of the prices_latest_week" as "Sum of the prices latest week",
"Sum of the prices_1week_before" as "Sum of the prices the week before",
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That's perfect, thank you 😄
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
