Is it possible to rename field values on a chart?

[3DGjos]

Im making a line chart for a client, with this query:

index=itsi_summary indexed_itsi_kpi_id=SHKPI-XXXXXXXX-cc5a-48c2-a238-fd37ff8XXXX OR indexed_itsi_kpi_id=SHKPI-XXXXXXXX-fdb0-4756-a979-97acfbd6XXXX| timechart span=15m  values(health_score) by indexed_itsi_kpi_id

the chart looks like this:

is there a way to rename the 2 values of the field to something more friendly like the services names? both are ITSI services IDs

[_gkollias · Accepted solution]

Hey @3DGjos - typically something like unique identifiers are too unique to rename unless you know you're going to use a specific one or set of them. For example, I can see the two UIDs are hardcoded in your base search which is possibly something you're looking to use later. You could rename the values to something more human friendly by using the if function of the eval command. Here is an example:

index=itsi_summary
( indexed_itsi_kpi_id=SHKPI-XXXXXXXX-cc5a-48c2-a238-fd37ff8XXXX OR indexed_itsi_kpi_id=SHKPI-XXXXXXXX-fdb0-4756-a979-97acfbd6XXXX )
| eval indexed_itsi_kpi_id = if(indexed_itsi_kpi_id="SHKPI-XXXXXXXX-cc5a-48c2-a238-fd37ff8XXXX", "Friendly Name 1", "Friendly Name 2")
| timechart span=15m values(health_score) by indexed_itsi_kpi_id

[kgderrekchapin]

I found a previous answers link that may help you with this.

https://answers.splunk.com/answers/525220/how-to-rename-column-values-when-making-a-chart.html