Rename row by data case at line chart

[Questioner]

I want to rename row value by data case. (It is line chart)

The line chart row name changed  by token $value$

if value is "iron" -> row must rename as "metal" -> and graph line become "black"

if value is "steak" -> row must rename as "food". -> and graph line become "red"

so I wrote the code like this, but it's not work at all.

<search>
<query>
...
  |eval dt = case("$value$" == "iron", "metal", 1=1, "food")
  |rename "row 1" as dt
...
</query>
</search>
<option name="charting.fieldColors">{"metal": 0xffffff, "food" : 0xFF0000}</option>

 How could I solve this problem?

[ITWhisperer · Accepted solution]

<search>
<query>
...
  |eval dt = case("$value$" == "iron", "metal", 1=1, "food")
  |eval {dt}='row 1'
...
</query>
</search>
<option name="charting.fieldColors">{"metal": 0xffffff, "food" : 0xFF0000}</option>

[Questioner]

I added this code under my code, but it show three rows 😢

row 1, "metal", "dt"

How could I solve this?

I added this line

<search>
<query>
...
  |sort total_time
  |transpose
  |eval dt = case("$value$" == "iron", "metal", 1=1, "food")
  |eval {dt}='row 1'
...
</query>
</search>
<option name="charting.fieldColors">{"metal": 0xffffff, "food" : 0xFF0000}</option>

[ITWhisperer]

| fields - dt "row 1"

[Questioner]

OHHH There is something wrong my code.

It work!
Thank you for your help!!!😀

[gcusello]

Hi @Questioner,

could you share the full search? it isn't clear the algorithm you used.

Ciao.

Giuseppe

[Questioner]

<row>

    <panel>

      <chart>

        <title>checking the making time</title>

        <search>

          <query>

  | where make_end_time &lt;= 50

  | where amount != "None"

              | where total_time &lt;= 15

              | where value_type = case("$v_type$"=="iron", 1, "$v_type$"=="steak", 2, 1=1, value_type)

              | eval get_start_time = prepare - welcome

              | eval wash_time = finish_wash - prepare

              | eval make = make_time - finish_wash

              | chart eval(round(avg(get_start_time), 3)) as "Start time" eval(round(avg(wash_time), 3)) as "cleaning" eval(round(avg(coook), 3)) as "making"

              | sort total_time

              |transpose 

              |rename "row 1" as "metal" |rename "row 2" as "food"</query>

        </search>

        <option name="charting.fieldColors">{"metal": 0xffffff, "food" : 0xFF0000}</option>

<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisMiddle</option>

        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>

        <option name="charting.axisTitleX.visibility">visible</option>

        <option name="charting.axisTitleY.text">time(s)</option>

        <option name="charting.axisTitleY.visibility">visible</option>

        <option name="charting.axisTitleY2.visibility">visible</option>

        <option name="charting.axisY.abbreviation">none</option>

        <option name="charting.axisY.scale">linear</option>

        <option name="charting.axisY2.enabled">0</option>

        <option name="charting.axisY2.scale">inherit</option>

        <option name="charting.chart">line</option>

        <option name="charting.chart.stackMode">default</option>

        <option name="charting.drilldown">all</option>

        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>

        <option name="charting.legend.mode">standard</option>

        <option name="charting.legend.placement">top</option>

        <option name="height">363</option>

        <option name="refresh.display">progressbar</option>

        <option name="trellis.enabled">0</option>

      </chart>

    </panel>

  </row>


This is my origin code! The data will send to the server