Splunk Search

How can I add extra labels to columns in charts?

dhruv101
Path Finder

Hi,

I create a chart using the following query which basically combines three fields and plots their count on a chart.
When I hover the mouse on any column I can see the phase name and count(as expected).

 index=“app_event” 
 | eval myFan=mvrange(0,3)
 | mvexpand myFan
 | eval time=case(myFan=0,$$payload.beginVal$$, myFan=1,$$payload.endVal$$, myFan=2,$$payload.anotherVal$$)
 | eval phase=case(myFan=0,"Start", myFan=1,"End", myFan=2,"Other")
 | eval Time= strftime (time, “%F %T.%9Q”)
 | chart count by Time phase

I now want to add an extra label($$payload.eventID$$) to every column such that when I hover over a column I am also able to see this label. How do I do this?

(PS I first tried concatenating this label to phase but then the chart starts counting by 'phase+payload.eventID' which I do not want. I want the chart to look the same, just with the new added label to each column.)

Thanks.

felipesewaybric
Contributor

I agree with the somesoni answer

0 Karma

somesoni2
Revered Legend

Just add following to end of your current search

| rename Start as "$$payload.eventID$$:Start" End as "$$payload.eventID$$:End" Other as "$$payload.eventID$$:Other"

vidhyaArumalla
Path Finder

This above solution helped me to solve a similar problem, Thanks @somesoni2

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...

Auto-Injector for Everything Else: Making OpenTelemetry Truly Universal

You might have seen Splunk’s recent announcement about donating the OpenTelemetry Injector to the ...