When i run the following query, my legend has the values as
index=main source=daily_report sourcetype=ironport_stats | chart values(malicious_url),values(detected_virus) over insert_date by server
How would I rename the values fields so they show up as what I want in the legend of the graph?
Thanks in advance!
If you use column-split options with charting commands like chart/timechart (
over field by field for
by field for
timechart), it'll creates columns which include the values of the by clause field.
..|chart count over field1 by field2 will give columns
field1, field2value1 field2value2.....
If you're using multiple aggregation, Splunk can't differentiate them with just the field1value, so it appends the aggregation column names as well.
..|chart count dc(field3) over field1 by field2 will give columns
field1, count:field2value1 count:field2value2... dc(field3):field2value1, dc(field3):field2value2.....
I would rename aggregation field within chart command itself to give a proper name so that chart generates series with proper names. E.g.
..|chart count dc(field3) as label over field1 by field2 will give columns
field1, count:field2value1 count:field2value2... label:field2value1, label:field2value2.....
What is the field name that you expect to come? Consider using stats instead of chart.
index=main source=dailyreport sourcetype=ironportstats | chart values(maliciousurl),values(detectedvirus) over insertdate by server | rename values(maliciousurl) as maliciousurl values(detectedvirus) as detected_virus