hi
I use a lookup in order to do a correspondance between the field web_error_code which is my sourcetype and which is an error code and the name of th error code
It works perfectly but I just need to complete the legend timechart with the original web_error code
for example I need "400 - Bad gateway", actually I have just bad gateway
How to do this please
index=toto sourcetype=tutu web_domain="*"
| lookup HttpCode.csv status as web_error_code output status_description
| timechart span=1d sum(web_error_count) as web_error_count by status_description
Create a field that combines the code with the description then use that field in the timechart.
index=toto sourcetype=tutu web_domain="*"
| lookup HttpCode.csv status as web_error_code output status_description
| eval code_description = web_error_code . " - " . status_description
| timechart span=1d sum(web_error_count) as web_error_count by code_description
Create a field that combines the code with the description then use that field in the timechart.
index=toto sourcetype=tutu web_domain="*"
| lookup HttpCode.csv status as web_error_code output status_description
| eval code_description = web_error_code . " - " . status_description
| timechart span=1d sum(web_error_count) as web_error_count by code_description
perfect thanks