Splunk Search

How do you change the legend value

Contributor

Outside of renaming(aliasing) the actual field, can you also rename the entire content of the history for charting? (i.e. instead of count(field/alias), rename it to Total Count of FIELD).

Tags (3)
0 Karma
1 Solution

Motivator

Yes you can, see below:

your search | chart count(foo) as "Total Count of FOO" by bar

View solution in original post

Motivator

Yes you can, see below:

your search | chart count(foo) as "Total Count of FOO" by bar

View solution in original post