I made a dashboard which has 2 pie charts and their status codes. How do I include a legend showing what the status codes mean?
Example, one pie chart shows only 3 status codes so far for today (200, 400, and 699).
status code = 200 means a successful web service call
status code = 400 means an unsuccessful web service call
status code = 699 means failed payment method
I want a legend to show up which gives a description of what the status codes represent so anyone looking at the dashboard could instantly know without having to go ask or look it up
I did something similar, but instead of a legend I modified the fields that the pie chart was displaying.
I started with a simple lookup table to map to my status codes:
500,Internal Server Error
505,HTTP Version Not Supported
There is also an http_status.csv file available on the Splunk Wiki: http://wiki.splunk.com/Http_status.csv
Next I just mapped the description to the status codes:
<query to get status codes> | stats count by status | lookup http_status status as status OUTPUT description
Then I created a new field that combines the status and the description and dumped it in a table with the count:
| eval status_description = status + " - " + description | table status_description, count
Now when you view the pie chart, you will get something like this:
Side note: If you didn't want to use a lookup table and only had a few status codes you wanted to display, you could also use a case statement to create your custom fields:
| eval status_description = case(status=200, "200 - Successful web service call", status=400, "400 - Unsuccessful web service call", status=669, "Failed payment method")
View solution in original post