Hi team, I have created a Splunk dashboard using the below query where we are displaying a metric as per stack IDs [i.e, "mdq.sId"]. The dashboards are displayed with legends showing the IDs 54 and 10662. I want to display these IDs with a different name corresponding to the stack IDs on the legends. For example, 54 is stack-ind and 10662 is stack-aus. index="pcs-ing"
ins="ingestion-worker"
"metric.ingestion.api.import.time" "mdq.sId" IN ("54","10662")
| timechart span=60m limit=0 count as ingestion_cycles by mdq.sId is it possible to search by the stackID but display on legends using alias names? For example, in the above dashboard, I want '54' to be shown as 'stack-ind' and '10664' as 'stack-aus'
... View more