Column Chart Legend always as count?

[wuming79]

Hi,

I'm trying to plot a bar chart to show the number of protocol scan in a network but my chart always shows my legend as count instead of protocol. How should I search so that the bar chart will show legend as many protocol and my column chart will see different colours for each different protocol?

[niketn · Accepted solution]

@wuming79, with your current query, protocol names are on x-axis. x-axis labels are not being shown in the visualization because there are too many of those you can try x-axis Label Rotation to -90° using Edit Format for the Column Chart. You can also try using Pie Chart as visualization for your data.

Having said that you try the following transpose command so that count takes x-axis and Protocol becomes legend.

<YourBaseSearch>
| stats count by Protocol
| transpose 0 header_field="Protocol" column_name="Protocol"