Dashboards & Visualizations

How to modify timewrap legend?

Clovisa
Path Finder

Hi ! I am trying to modify the legend generated by the timewrap command. I saw that we could slightly change it with the parameter "series" but it's not really giving me what I want.

Let's say I want to have a sum of prices from this request :

index=sandbox earliest=-13d | timechart sum(prices) as "Sum of the prices" span=d | timewrap 1w series=relative

The legend will be Sum of the prices_1week_before and Sum of the prices_latest_week . I would like to have something like Sum of the prices for the week before and Sum of the prices for the latest week .

How can I get this ? Thanks !

0 Karma
1 Solution

niketn
Legend

One option would be to use series="exact" option to provide format for time series i.e.

<yourCurrentSearch>
| timewrap 1w series=exact time_format="Sum of the prices for %Y-%U week"

If you intend to use series="relative", you can use rename command to change series name as required (relative option will generate some generic names as per the series name in the timechart.

<yourCurrentSearch>
| timewrap 1w series=relative
| rename "Sum of the prices_latest_week" as  "Sum of the prices latest week",
         "Sum of the prices_1week_before" as  "Sum of the prices the week before",
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

One option would be to use series="exact" option to provide format for time series i.e.

<yourCurrentSearch>
| timewrap 1w series=exact time_format="Sum of the prices for %Y-%U week"

If you intend to use series="relative", you can use rename command to change series name as required (relative option will generate some generic names as per the series name in the timechart.

<yourCurrentSearch>
| timewrap 1w series=relative
| rename "Sum of the prices_latest_week" as  "Sum of the prices latest week",
         "Sum of the prices_1week_before" as  "Sum of the prices the week before",
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

Clovisa
Path Finder

That's perfect, thank you 😄

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...