Dashboards & Visualizations
Highlighted

replacing host values in a chart

Champion

Hi,

I have a chart that works, but mgmt wants the host values to map to something more meaningful. Is there a way to do this?

My search is this:

index=coreops sourcetype=snmpinfo source="/usr/local/nsmutils/varlog/splunkcgksessions.log" | head 9 | chart sum(CONNECTIONS) as CONNECTIONS by HOST | eval H=HOST | eval HOST="" | xyseries HOST H CONNECTIONS

Tags (2)
0 Karma
Highlighted

Re: replacing host values in a chart

Legend

Well how would you define "useful" in your scenario?

Highlighted

Re: replacing host values in a chart

Communicator

You might consider doing a lookup on HOST?

View solution in original post

Highlighted

Re: replacing host values in a chart

Champion

lookup worked. The customer didn't like the name of the hosts, so we mapped it via a lookup.

0 Karma