Splunk Search

Human Redable Legend text without using case

Path Finder


My log snippet is as shown below:

productid=12 email=abc@gg.com 
productid=13 email=pqr@aa.com 
productid=14 email=xyz@cc.com 
productid=15 email=xyz@cc.com

I've a timechart with below query:

index=myindex sourcetype=mylog
| eval    
| timechart count by productname usenull=f

Here, I'm using case since I need to show legend in human readable format but the problem is that I may have more than 15 productids in future. And I don't want to hard code them all in case condition. Is there any other way to display legend without this comparision?

Any help is much appreciated!


Tags (3)
0 Karma


Have you looked into using a lookup to translate productid to human readable product names?

Take a look at http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources?r=sear... -> it's a really powerful and handy command.


State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!