Im making a line chart for a client, with this query:
index=itsi_summary indexed_itsi_kpi_id=SHKPI-XXXXXXXX-cc5a-48c2-a238-fd37ff8XXXX OR indexed_itsi_kpi_id=SHKPI-XXXXXXXX-fdb0-4756-a979-97acfbd6XXXX| timechart span=15m values(health_score) by indexed_itsi_kpi_id
the chart looks like this:
is there a way to rename the 2 values of the field to something more friendly like the services names? both are ITSI services IDs
Hey @3DGjos - typically something like unique identifiers are too unique to rename unless you know you're going to use a specific one or set of them. For example, I can see the two UIDs are hardcoded in your base search which is possibly something you're looking to use later. You could rename the values to something more human friendly by using the if
function of the eval
command. Here is an example:
index=itsi_summary
( indexed_itsi_kpi_id=SHKPI-XXXXXXXX-cc5a-48c2-a238-fd37ff8XXXX OR indexed_itsi_kpi_id=SHKPI-XXXXXXXX-fdb0-4756-a979-97acfbd6XXXX )
| eval indexed_itsi_kpi_id = if(indexed_itsi_kpi_id="SHKPI-XXXXXXXX-cc5a-48c2-a238-fd37ff8XXXX", "Friendly Name 1", "Friendly Name 2")
| timechart span=15m values(health_score) by indexed_itsi_kpi_id
Hey @3DGjos - typically something like unique identifiers are too unique to rename unless you know you're going to use a specific one or set of them. For example, I can see the two UIDs are hardcoded in your base search which is possibly something you're looking to use later. You could rename the values to something more human friendly by using the if
function of the eval
command. Here is an example:
index=itsi_summary
( indexed_itsi_kpi_id=SHKPI-XXXXXXXX-cc5a-48c2-a238-fd37ff8XXXX OR indexed_itsi_kpi_id=SHKPI-XXXXXXXX-fdb0-4756-a979-97acfbd6XXXX )
| eval indexed_itsi_kpi_id = if(indexed_itsi_kpi_id="SHKPI-XXXXXXXX-cc5a-48c2-a238-fd37ff8XXXX", "Friendly Name 1", "Friendly Name 2")
| timechart span=15m values(health_score) by indexed_itsi_kpi_id
I found a previous answers link that may help you with this.
https://answers.splunk.com/answers/525220/how-to-rename-column-values-when-making-a-chart.html