Splunk Search

Is it possible rename values when displayed on a chart?

asherman
Path Finder

I am trying to produce a query that represents a bunch of queries concatenated. My search is in a dashboard and looks like:

index=$index$ name=$name$ | eval min=round(min,3) | eval max=round(max,3) | chart values(min) as Min, values(max) as Max by path

When $name$ is specified, I get a chart over a range of 'paths' from 1->50. Each valid $name$ has 50 paths. If I set name=*, then I get conflicting values for each path (i.e., every $name$ has the same path names), so charting the results doesn't produce anything. I believe I could get around this if I could rename the paths to, for example, concatenate the names (e.g., path=name.path) - but I can't seem to get the query to cooperate. The ideal result is that the final chart resembles each of the individual charts concatenated together side by side.

Data is stored as comma delimited key=value pairs. E.g., name=my_test,path=1,min=3.917,max=5.232.

Any suggestions?

Much thanks!

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

This should work:

index=$index$ name=$name$ | eval min=round(min,3) | eval max=round(max,3)
| eval name_path = name ."_". path
| chart values(min) as Min, values(max) as Max by name_path

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

This should work:

index=$index$ name=$name$ | eval min=round(min,3) | eval max=round(max,3)
| eval name_path = name ."_". path
| chart values(min) as Min, values(max) as Max by name_path

martin_mueller
SplunkTrust
SplunkTrust

After a chart foo by path there is no name field left to use 😛

0 Karma

asherman
Path Finder

Ahh, thanks. I was trying to change the name after the chart, but this makes a lot more sense!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...