display legend values with different names on splunk dashboard

[rpole]

Hi team, 

I have created a Splunk dashboard using the below query where we are displaying a metric as per stack IDs [i.e, "mdq.sId"]. The dashboards are displayed with legends showing the IDs 54 and 10662. I want to display these IDs with a different name corresponding to the stack IDs on the legends. 

For example, 54 is stack-ind and 10662 is stack-aus.

index="pcs-ing" 
ins="ingestion-worker"
"metric.ingestion.api.import.time" "mdq.sId" IN ("54","10662")
| timechart span=60m limit=0 count as ingestion_cycles by mdq.sId

is it possible to search by the stackID but display on legends using alias names? For example, in the above dashboard, I want '54'  to be shown as 'stack-ind' and '10664' as 'stack-aus' 

[gcusello]

Hi @rpole ,

You could use a label using eval command, somtethinl like this:

index="pcs-ing" 
ins="ingestion-worker"
"metric.ingestion.api.import.time" "mdq.sId" IN ("57","10662")
| rename mdq.sId as mdq_sId
| eval mdq=if(mdq_sId="57","stack-ind","stack-aus"
| timechart span=60m limit=0 count as ingestion_cycles by mdq

If it's possibile, use underscore "_" instead minus "-".

Ciao.

Giuseppe

[rpole]

@gcusello 

Thanks for the suggestion. This worked with only two stackIDs.  what if I have multiple stackIDs to be displayed?? 

[gcusello]

Hi @rpole ,

use the case function in the eval command if they are few, or use a lookup containing the association between the codes and the descriptions if they are many.

Ciao.

Giuseppe