Dashboards & Visualizations

How to change the graph legend labels for a trendline in Splunk?

umichguy
Explorer

I have the following search displaying a trendline as part of visualization:

index=mail sourcetype=abc_mail action=4 OR action=2 OR action=0 | timechart count by action

Here, '4' means 'allowed', '0' means 'denied' and '2' means 'quarantined'. Currently, the graph legend just shows '0' '2' and '4' as labels to the trendlines. I want to write 'allowed' 'denied' and 'quarantined' there instead so that it makes more sense to someone who doesn't know what these codes mean.

How can I do this in Splunk?

0 Karma
1 Solution

woodcock
Esteemed Legend

Typically this is done with a lookup but for so few values, you can do this:

index=mail sourcetype=abc_mail action=4 OR action=2 OR action=0
| eval action=case((action=0), "Denied",
                   (action=2), "Quarantined",
                   (action=4), "Allowed",
                       true(), "IMPOSSIBLE!")
| timechart count by action

View solution in original post

woodcock
Esteemed Legend

Typically this is done with a lookup but for so few values, you can do this:

index=mail sourcetype=abc_mail action=4 OR action=2 OR action=0
| eval action=case((action=0), "Denied",
                   (action=2), "Quarantined",
                   (action=4), "Allowed",
                       true(), "IMPOSSIBLE!")
| timechart count by action

unnigec
Engager

Thanks, I had a similar scenario and this worked.

0 Karma

pal4life
Path Finder

I am trying to convert my month no to Month name - 1 2 3 to Jan Feb Mar but it does not seem to work with just the rename

0 Karma

umichguy
Explorer

I just tried it. And it seems to now label the legend as '0' '2' and '4' (as earlier) and then adds another label 'action' on there. It does not really resolve the codes to text.

0 Karma

umichguy
Explorer

OK. I modified it and now it works. I needed to do the 'eval' first and then 'timechart' after. If you modify the answer above accordingly, I will accept it as correct 🙂

0 Karma

woodcock
Esteemed Legend

Right, I switched it around, I forgot that timchart converts values to field names. You can also do this:

index=mail sourcetype=abc_mail action=4 OR action=2 OR action=0
| timechart count by action
| rename 0 AS Denied 2 AS Quarantined 4 AS Allowed

pal4life
Path Finder

I am trying to convert my month no to Month name - 1 2 3 to Jan Feb Mar but it does not seem to work with just the rename

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...