Splunk IT Service Intelligence

Is it possible to rename field values on a chart?

3DGjos
Communicator

Im making a line chart for a client, with this query:

index=itsi_summary indexed_itsi_kpi_id=SHKPI-XXXXXXXX-cc5a-48c2-a238-fd37ff8XXXX OR indexed_itsi_kpi_id=SHKPI-XXXXXXXX-fdb0-4756-a979-97acfbd6XXXX| timechart span=15m  values(health_score) by indexed_itsi_kpi_id

the chart looks like this:

alt text

is there a way to rename the 2 values of the field to something more friendly like the services names? both are ITSI services IDs

1 Solution

_gkollias
SplunkTrust
SplunkTrust

Hey @3DGjos - typically something like unique identifiers are too unique to rename unless you know you're going to use a specific one or set of them. For example, I can see the two UIDs are hardcoded in your base search which is possibly something you're looking to use later. You could rename the values to something more human friendly by using the if function of the eval command. Here is an example:

index=itsi_summary
( indexed_itsi_kpi_id=SHKPI-XXXXXXXX-cc5a-48c2-a238-fd37ff8XXXX OR indexed_itsi_kpi_id=SHKPI-XXXXXXXX-fdb0-4756-a979-97acfbd6XXXX )
| eval indexed_itsi_kpi_id = if(indexed_itsi_kpi_id="SHKPI-XXXXXXXX-cc5a-48c2-a238-fd37ff8XXXX", "Friendly Name 1", "Friendly Name 2")
| timechart span=15m values(health_score) by indexed_itsi_kpi_id

View solution in original post

_gkollias
SplunkTrust
SplunkTrust

Hey @3DGjos - typically something like unique identifiers are too unique to rename unless you know you're going to use a specific one or set of them. For example, I can see the two UIDs are hardcoded in your base search which is possibly something you're looking to use later. You could rename the values to something more human friendly by using the if function of the eval command. Here is an example:

index=itsi_summary
( indexed_itsi_kpi_id=SHKPI-XXXXXXXX-cc5a-48c2-a238-fd37ff8XXXX OR indexed_itsi_kpi_id=SHKPI-XXXXXXXX-fdb0-4756-a979-97acfbd6XXXX )
| eval indexed_itsi_kpi_id = if(indexed_itsi_kpi_id="SHKPI-XXXXXXXX-cc5a-48c2-a238-fd37ff8XXXX", "Friendly Name 1", "Friendly Name 2")
| timechart span=15m values(health_score) by indexed_itsi_kpi_id

View solution in original post

kgderrekchapin
Path Finder

I found a previous answers link that may help you with this.

https://answers.splunk.com/answers/525220/how-to-rename-column-values-when-making-a-chart.html

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!