Splunk Search

How to change the name of field values at y-axis

Maniteja81
New Member

Hi,

My idea is to shorten the value names at y-axis to a meaning full short names, so that it doesn't get truncated while viewing in chart.

Here is my query:
index=qvmr_qvmregress_r groupID=qvmr_dev rsti_thumb_print=rsti_fvcad_ds_Thu_May_10_22_06_55_2018_fvcad-jenkins-01_fvcad_ds OR rsti_thumb_print=rsti_fvcad_ds_Thu_May_10_03_45_41_2018_fvcad-jenkins-01_fvcad_ds OR rsti_thumb_print=rsti_c_vidyak_Thu_May_31_03_44_55_2018_vl-c-vidyak-ice_c_vidyak | makemv delim="," version_vector |eval success=if(isnotnull(success) and success="","FAIL",success)|eval success=if(success="1","PASS",success)| eval success=if(success="0","FAIL",success) | eval success=if(success="-1","UNFINISHED",success)|makemv delim="," version_vector| stats list(actual_status) as l_status,list(success) as status ,list(version_vector) as vv by dut_id,rsti_thumb_print | eval status=if(isnull(status),"SCHEDULED",status) | search vv=* |stats count(eval(status=="PASS")) as pass_count count(eval(status=="FAIL")) as fail_count count(eval(status=="SCHEDULED")) as incmp_count count(eval("PASS"+"FAIL"+"SCHEDULED")) as total_count by rsti_thumb_print | appendcols [search index=qvmr_qvmregress_r groupID=qvmr_dev rsti_thumb_print=rsti_fvcad_ds_Thu_May_10_22_06_55_2018_fvcad-jenkins-01_fvcad_ds upload_type!=final_status | makemv delim="," version_vector | stats count(dut_id) as max_tests by rsti_thumb_print] | eval pass_pct=round(pass_count*100/total_count,2) | eval fail_pct=round(fail_count*100/total_count,2) | eval incmp_pct=round(incmp_count*100/total_count, 2) | eval diff_tests=max_tests-total_count | stats list(diff_tests) as "Extra Tests", list(pass_pct) as "PASS %", list(fail_pct) as "FAIL %", list(incmp_pct) as "UNFINISHED %" by rsti_thumb_print | replace "rsti_fvcad_ds_Thu_May_10_22_06_55_2018_fvcad-jenkins-01_fvcad_ds" WITH RUN1, "rsti_fvcad_ds_Thu_May_10_03_45_41_2018_fvcad-jenkins-01_fvcad_ds OR rsti_thumb_print=rsti_c_vidyak_Thu_May_31_03_44_55_2018_vl-c-vidyak-ice_c_vidyak" WITH RUN2 IN rsti_thumb_print

I tried replace command, but it is working only for some extent. Since i'm relying on one token to get some values, that token has default delimeter as "OR rsti_thumb_print=". So due to this the replace command is failing.

Any help will be appreciated.
alt text

Tags (2)
0 Karma

PowerPacked
Builder

Hi @Maniteja81

You can use this settings on the right hand top side of the dashboard panel to make the changes

alt text

the legend truncation gives you option to choose the y axis field values to be shown as - starting, start..end, ending.

if you want to change the field values completely, you may need to rename them in the search only.

Thanks

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...