sourcetype="pan:threat" earliest=-1d | timechart span=5m count by threat_name limit=8 I am doing a search like the one above, and one of the legend labels for the threat_name only comes up with the ID number not the actual name, ie. URL filtering for 9999 in the legend. The other labels come up correctly. I am trying to find where I can change the 9999 to a URL filtering (9999) or something like that? Is this a case that I would use an eval/case statement. I have tried and was unsuccessful in forming a correct one to get what I was hoping for. Thank you in advance. -Sam ... View more