Dashboards & Visualizations

how do I change a legend label for a graph?

samceballos
New Member

sourcetype="pan:threat" earliest=-1d | timechart span=5m count by threat_name limit=8

I am doing a search like the one above, and one of the legend labels for the threat_name only comes up with the ID number not the actual name, ie. URL filtering for 9999 in the legend. The other labels come up correctly. I am trying to find where I can change the 9999 to a URL filtering (9999) or something like that? Is this a case that I would use an eval/case statement. I have tried and was unsuccessful in forming a correct one to get what I was hoping for. Thank you in advance.

-Sam

0 Karma
1 Solution

msivill_splunk
Splunk Employee
Splunk Employee

I've answered something similar here https://answers.splunk.com/answers/687775/how-do-i-make-a-search-string-to-get-real-time-dat.html

The solution there was to pipe the result into the rename command

View solution in original post

0 Karma

samceballos
New Member

sourcetype="pan:threat" earliest=-1d | timechart span=5m count by threat_name limit=8 | rename "(9999)" as "URL Filtering(9999)"

rename "(9999)" as "URL Filtering(9999)" is what I was missing. Thanks for the answer.

0 Karma

msivill_splunk
Splunk Employee
Splunk Employee

I've answered something similar here https://answers.splunk.com/answers/687775/how-do-i-make-a-search-string-to-get-real-time-dat.html

The solution there was to pipe the result into the rename command

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...