Splunk Search
Highlighted

How do you change the legend value

Contributor

Outside of renaming(aliasing) the actual field, can you also rename the entire content of the history for charting? (i.e. instead of count(field/alias), rename it to Total Count of FIELD).

Tags (3)
0 Karma
Highlighted

Re: How do you change the legend value

Motivator

Yes you can, see below:

your search | chart count(foo) as "Total Count of FOO" by bar

View solution in original post