Display different values as different labels

[wicke_s]

I am creating a splunk dashboard pie chart panel and the values I am displaying are too large (long strings) to be displayed in a small panel. Is it possible to display the chart values in a readable / concise labels?

For e.g., If the below is my sample query:

index=network sourcetype=logserver | stats dc(Field.ID) by Field.Message

If Field.Message is "All transfers were successful", I want to display just "Success" in the pie chart
If Field.Message is "Some transfers failed", I want to display just "Failed"

and so on..

What is the best way to achieve this? Thanks in advance

[anilchaithu]

@wicke_s 

you can change the field values in the query using the below logic. This will change the label in the pie chart 

index=network sourcetype=logserver | stats dc(Field.ID) by Field.Message | replace "All transfers were successful" with Success in Field.Message

[dmarling · Accepted solution]

Hello @wicke_s,

The simplest method would be to create an eval that adjusted the output of the Field.Message so it matches your requirements:

index=network sourcetype=logserver 
| eval "Field.Message"=case('Field.Message'="All transfers were successful", "Success", 'Field.Message'="Some transfers failed", "Failed", 1=1, "Other")
| stats dc(Field.ID) by Field.Message

If you have more messages that are unaccounted for you can modify it to be a bit more generic using LIKE:

index=network sourcetype=logserver 
| eval "Field.Message"=case('Field.Message' LIKE "%successful%", "Success", 'Field.Message' LIKE "%failed%", "Failed", 1=1, "Other")
| stats dc(Field.ID) by Field.Message

Ultimately that eval will need to account for all of your use cases or you will end up with a large "Other" bucket.

[wicke_s]

Thank you @dmarling , That worked. I have a follow up question about your "Other" bucket comment. What if not all the values of the Field.Message is known before hand? For e.g., Can we display

"All transfers were successful" as "Success"

"Some transfers failed" as "Failed"

and display all other Field.Message values as it is

[dmarling]

You sure can.  Just modify it slightly:

| eval "Field.Message"=case('Field.Message'="All transfers were successful", "Success", 'Field.Message'="Some transfers failed", "Failed", 1=1, 'Field.Message')

[wicke_s]

@dmarling  Exactly what I was looking for, Thank you so much!!