Splunk ITSI

Is it possible to rename field values on a chart?

3DGjos
Communicator

Im making a line chart for a client, with this query:

index=itsi_summary indexed_itsi_kpi_id=SHKPI-XXXXXXXX-cc5a-48c2-a238-fd37ff8XXXX OR indexed_itsi_kpi_id=SHKPI-XXXXXXXX-fdb0-4756-a979-97acfbd6XXXX| timechart span=15m  values(health_score) by indexed_itsi_kpi_id

the chart looks like this:

alt text

is there a way to rename the 2 values of the field to something more friendly like the services names? both are ITSI services IDs

1 Solution

_gkollias
Builder

Hey @3DGjos - typically something like unique identifiers are too unique to rename unless you know you're going to use a specific one or set of them. For example, I can see the two UIDs are hardcoded in your base search which is possibly something you're looking to use later. You could rename the values to something more human friendly by using the if function of the eval command. Here is an example:

index=itsi_summary
( indexed_itsi_kpi_id=SHKPI-XXXXXXXX-cc5a-48c2-a238-fd37ff8XXXX OR indexed_itsi_kpi_id=SHKPI-XXXXXXXX-fdb0-4756-a979-97acfbd6XXXX )
| eval indexed_itsi_kpi_id = if(indexed_itsi_kpi_id="SHKPI-XXXXXXXX-cc5a-48c2-a238-fd37ff8XXXX", "Friendly Name 1", "Friendly Name 2")
| timechart span=15m values(health_score) by indexed_itsi_kpi_id

View solution in original post

_gkollias
Builder

Hey @3DGjos - typically something like unique identifiers are too unique to rename unless you know you're going to use a specific one or set of them. For example, I can see the two UIDs are hardcoded in your base search which is possibly something you're looking to use later. You could rename the values to something more human friendly by using the if function of the eval command. Here is an example:

index=itsi_summary
( indexed_itsi_kpi_id=SHKPI-XXXXXXXX-cc5a-48c2-a238-fd37ff8XXXX OR indexed_itsi_kpi_id=SHKPI-XXXXXXXX-fdb0-4756-a979-97acfbd6XXXX )
| eval indexed_itsi_kpi_id = if(indexed_itsi_kpi_id="SHKPI-XXXXXXXX-cc5a-48c2-a238-fd37ff8XXXX", "Friendly Name 1", "Friendly Name 2")
| timechart span=15m values(health_score) by indexed_itsi_kpi_id

kgderrekchapin
Path Finder

I found a previous answers link that may help you with this.

https://answers.splunk.com/answers/525220/how-to-rename-column-values-when-making-a-chart.html

Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...