Dashboards & Visualizations

How to change the graph legend labels for a trendline in Splunk?

umichguy
Explorer

I have the following search displaying a trendline as part of visualization:

index=mail sourcetype=abc_mail action=4 OR action=2 OR action=0 | timechart count by action

Here, '4' means 'allowed', '0' means 'denied' and '2' means 'quarantined'. Currently, the graph legend just shows '0' '2' and '4' as labels to the trendlines. I want to write 'allowed' 'denied' and 'quarantined' there instead so that it makes more sense to someone who doesn't know what these codes mean.

How can I do this in Splunk?

0 Karma
1 Solution

woodcock
Esteemed Legend

Typically this is done with a lookup but for so few values, you can do this:

index=mail sourcetype=abc_mail action=4 OR action=2 OR action=0
| eval action=case((action=0), "Denied",
                   (action=2), "Quarantined",
                   (action=4), "Allowed",
                       true(), "IMPOSSIBLE!")
| timechart count by action

View solution in original post

woodcock
Esteemed Legend

Typically this is done with a lookup but for so few values, you can do this:

index=mail sourcetype=abc_mail action=4 OR action=2 OR action=0
| eval action=case((action=0), "Denied",
                   (action=2), "Quarantined",
                   (action=4), "Allowed",
                       true(), "IMPOSSIBLE!")
| timechart count by action

View solution in original post

unnigec
Engager

Thanks, I had a similar scenario and this worked.

0 Karma

pal4life
Path Finder

I am trying to convert my month no to Month name - 1 2 3 to Jan Feb Mar but it does not seem to work with just the rename

0 Karma

umichguy
Explorer

I just tried it. And it seems to now label the legend as '0' '2' and '4' (as earlier) and then adds another label 'action' on there. It does not really resolve the codes to text.

0 Karma

umichguy
Explorer

OK. I modified it and now it works. I needed to do the 'eval' first and then 'timechart' after. If you modify the answer above accordingly, I will accept it as correct 🙂

0 Karma

woodcock
Esteemed Legend

Right, I switched it around, I forgot that timchart converts values to field names. You can also do this:

index=mail sourcetype=abc_mail action=4 OR action=2 OR action=0
| timechart count by action
| rename 0 AS Denied 2 AS Quarantined 4 AS Allowed
0 Karma

pal4life
Path Finder

I am trying to convert my month no to Month name - 1 2 3 to Jan Feb Mar but it does not seem to work with just the rename

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!