how to change display name in chart

[avikc100]

this is my splunk query:

index="webmethods_prd"  source="/apps/WebMethods/IntegrationServer/instances/default/logs/ExternalPACA.log" |eval timestamp=strftime(_time, "%F") | chart limit=30 count as count over source by timestamp

it is showing result as :

but I want to add a custom name to it, how should I do that?

[gcusello]

Hi @avikc100 ,

you have to use the eval command to change the source value.

so you could use the case statment having many values:

| eval source=case(
     source="*PACA.log", "Canada Pricing Call",
     source="*second_value.log" "Second value",
     source="*third_value.log" "Third value")

Ciao.

Giuseppe

[avikc100]

I am getting blank value

index="webmethods_prd" host="USPGH-WMA2AISP*" source="/apps/WebMethods/IntegrationServer/instances/default/logs/ExternalPAEU.log" ("success" OR "fail*")| eval status = if(searchmatch("success"), "Success", "Error")|stats count by source,status| xyseries source status count| eval source=case(
source="*PAEU.log", "Canada Pricing Call")

[gcusello]

Hi @avikc100 ,

why did you used xyseries after stats?

please try:

index="webmethods_prd" host="USPGH-WMA2AISP*" source="/apps/WebMethods/IntegrationServer/instances/default/logs/ExternalPAEU.log" ("success" OR "fail*")
| eval status = if(searchmatch("success"), "Success", "Error")
| stats count by source status
| eval source=if(source="*PAEU.log", "Canada Pricing Call","XXX")

Ciao.

Giuseppe

[avikc100]

I am getting blank value

index="webmethods_prd" host="USPGH-WMA2AISP*" source="/apps/WebMethods/IntegrationServer/instances/default/logs/ExternalPAEU.log" ("success" OR "fail*")| eval status = if(searchmatch("success"), "Success", "Error")|stats count by source,status| xyseries source status count| eval source=case(
source="*PACA.log", "Canada Pricing Call")