I have piechart created and i want to rename the values that i have for all the pie slices .
@navd, if the field name for pie chart label is field
, you can apply the following replace() command with regex match to retain only text after semicolon.
<YourCurrentSearch>
| eval <yourFieldName>=replace(<yourFieldName>,"([^;]+);(.*)","\2")
Following is the run anywhere search for reference:
| makeresults
| eval field="compute;good count(6424)", value=6424
| append [| makeresults
| eval field="server;notify count(64)", value=64]
| fields - _time
| eval field=replace(field,"([^;]+);(.*)","\2")
@navd, is this different from your previous question https://answers.splunk.com/answers/614546/display-the-values-on-pie-slice-in-pie-chart.html ?
yes ,now I wanted to rename
Ok, refer to answer below for this question. Also please accept the answer to your previous question if one of the suggested answers has worked out for you.
You can try case statement:
<base search>|eval etc_state=case(etc_state=="compute;good" ,"good",etc_state=="server;notify","notify",1==1,"")
HI @navd,
The labels are coming for events so you have to change before chart or stats command.
Can you please share your sample search & sample data (old label and new label)?
Thanks
I have the statistics like this :
compute;good count(6424) 6424
server;notify count(64) 64
So,here I want to rename compute;good as Good and server;notify as notify