Splunk Search

Human Redable Legend text without using case

Path Finder


My log snippet is as shown below:

productid=12 email=abc@gg.com 
productid=13 email=pqr@aa.com 
productid=14 email=xyz@cc.com 
productid=15 email=xyz@cc.com

I've a timechart with below query:

index=myindex sourcetype=mylog
| eval    
| timechart count by productname usenull=f

Here, I'm using case since I need to show legend in human readable format but the problem is that I may have more than 15 productids in future. And I don't want to hard code them all in case condition. Is there any other way to display legend without this comparision?

Any help is much appreciated!


Tags (3)
0 Karma


Have you looked into using a lookup to translate productid to human readable product names?

Take a look at http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources?r=sear... -> it's a really powerful and handy command.