help to legend field name after using a lookup correspondance

[jip31]

hi

I use a lookup in order to do a correspondance between the field web_error_code which is my sourcetype and which is an error code and the name of th error code

It works perfectly but I just need to complete the legend timechart with the original web_error code

for example I need "400 - Bad gateway", actually I have just bad gateway

How to do this please

index=toto sourcetype=tutu web_domain="*"   
| lookup HttpCode.csv status as web_error_code output status_description 
| timechart span=1d  sum(web_error_count) as web_error_count by status_description 

[richgalloway · Accepted solution]

Create a field that combines the code with the description then use that field in the timechart.

index=toto sourcetype=tutu web_domain="*"   
| lookup HttpCode.csv status as web_error_code output status_description 
| eval code_description = web_error_code . " - " . status_description
| timechart span=1d  sum(web_error_count) as web_error_count by code_description

[jip31]

perfect thanks