Splunk Search

Display different values as different labels

wicke_s
Explorer

I am creating a splunk dashboard pie chart panel and the values I am displaying are too large (long strings) to be displayed in a small panel. Is it possible to display the chart values in a readable / concise labels?

For e.g., If the below is my sample query:

index=network sourcetype=logserver | stats dc(Field.ID) by Field.Message

 

If Field.Message is "All transfers were successful", I want to display just "Success" in the pie chart
If Field.Message is "Some transfers failed", I want to display just "Failed"

and so on..

 

What is the best way to achieve this? Thanks in advance

 

Labels (1)
0 Karma
1 Solution

dmarling
Builder

Hello @wicke_s,

The simplest method would be to create an eval that adjusted the output of the Field.Message so it matches your requirements:

index=network sourcetype=logserver 
| eval "Field.Message"=case('Field.Message'="All transfers were successful", "Success", 'Field.Message'="Some transfers failed", "Failed", 1=1, "Other")
| stats dc(Field.ID) by Field.Message

If you have more messages that are unaccounted for you can modify it to be a bit more generic using LIKE:

index=network sourcetype=logserver 
| eval "Field.Message"=case('Field.Message' LIKE "%successful%", "Success", 'Field.Message' LIKE "%failed%", "Failed", 1=1, "Other")
| stats dc(Field.ID) by Field.Message

Ultimately that eval will need to account for all of your use cases or you will end up with a large "Other" bucket.

If this comment/answer was helpful, please up vote it. Thank you.

View solution in original post

anilchaithu
Builder

@wicke_s 

you can change the field values in the query using the below logic. This will change the label in the pie chart 

index=network sourcetype=logserver | stats dc(Field.ID) by Field.Message | replace "All transfers were successful" with Success in Field.Message

dmarling
Builder

Hello @wicke_s,

The simplest method would be to create an eval that adjusted the output of the Field.Message so it matches your requirements:

index=network sourcetype=logserver 
| eval "Field.Message"=case('Field.Message'="All transfers were successful", "Success", 'Field.Message'="Some transfers failed", "Failed", 1=1, "Other")
| stats dc(Field.ID) by Field.Message

If you have more messages that are unaccounted for you can modify it to be a bit more generic using LIKE:

index=network sourcetype=logserver 
| eval "Field.Message"=case('Field.Message' LIKE "%successful%", "Success", 'Field.Message' LIKE "%failed%", "Failed", 1=1, "Other")
| stats dc(Field.ID) by Field.Message

Ultimately that eval will need to account for all of your use cases or you will end up with a large "Other" bucket.

If this comment/answer was helpful, please up vote it. Thank you.

wicke_s
Explorer

Thank you @dmarling , That worked. I have a follow up question about your "Other" bucket comment. What if not all the values of the Field.Message is known before hand? For e.g., Can we display

 

"All transfers were successful" as "Success"

"Some transfers failed" as "Failed"

and display all other Field.Message values as it is

0 Karma

dmarling
Builder

You sure can.  Just modify it slightly:

 

| eval "Field.Message"=case('Field.Message'="All transfers were successful", "Success", 'Field.Message'="Some transfers failed", "Failed", 1=1, 'Field.Message')
If this comment/answer was helpful, please up vote it. Thank you.

wicke_s
Explorer

@dmarling  Exactly what I was looking for, Thank you so much!!

0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...