Human Redable Legend text without using case

[freephoneid]

Hi,

My log snippet is as shown below:

productid=12 [email protected] 
productid=13 [email protected] 
productid=14 [email protected] 
productid=15 [email protected]

I've a timechart with below query:

index=myindex sourcetype=mylog
| eval    
productname=case(productid==12,"Product1",productid==13,"Product2",productid==14,"Product3")
| timechart count by productname usenull=f

Here, I'm using case since I need to show legend in human readable format but the problem is that I may have more than 15 productids in future. And I don't want to hard code them all in case condition. Is there any other way to display legend without this comparision?

Any help is much appreciated!

Thanks!

[Brian_Osburn]

Have you looked into using a lookup to translate productid to human readable product names?

Take a look at http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources?r=sear... -> it's a really powerful and handy command.

Brian