Splunk Search

How to change the name of field values at y-axis

Maniteja81
New Member

Hi,

My idea is to shorten the value names at y-axis to a meaning full short names, so that it doesn't get truncated while viewing in chart.

Here is my query:
index=qvmr_qvmregress_r groupID=qvmr_dev rsti_thumb_print=rsti_fvcad_ds_Thu_May_10_22_06_55_2018_fvcad-jenkins-01_fvcad_ds OR rsti_thumb_print=rsti_fvcad_ds_Thu_May_10_03_45_41_2018_fvcad-jenkins-01_fvcad_ds OR rsti_thumb_print=rsti_c_vidyak_Thu_May_31_03_44_55_2018_vl-c-vidyak-ice_c_vidyak | makemv delim="," version_vector |eval success=if(isnotnull(success) and success="","FAIL",success)|eval success=if(success="1","PASS",success)| eval success=if(success="0","FAIL",success) | eval success=if(success="-1","UNFINISHED",success)|makemv delim="," version_vector| stats list(actual_status) as l_status,list(success) as status ,list(version_vector) as vv by dut_id,rsti_thumb_print | eval status=if(isnull(status),"SCHEDULED",status) | search vv=* |stats count(eval(status=="PASS")) as pass_count count(eval(status=="FAIL")) as fail_count count(eval(status=="SCHEDULED")) as incmp_count count(eval("PASS"+"FAIL"+"SCHEDULED")) as total_count by rsti_thumb_print | appendcols [search index=qvmr_qvmregress_r groupID=qvmr_dev rsti_thumb_print=rsti_fvcad_ds_Thu_May_10_22_06_55_2018_fvcad-jenkins-01_fvcad_ds upload_type!=final_status | makemv delim="," version_vector | stats count(dut_id) as max_tests by rsti_thumb_print] | eval pass_pct=round(pass_count*100/total_count,2) | eval fail_pct=round(fail_count*100/total_count,2) | eval incmp_pct=round(incmp_count*100/total_count, 2) | eval diff_tests=max_tests-total_count | stats list(diff_tests) as "Extra Tests", list(pass_pct) as "PASS %", list(fail_pct) as "FAIL %", list(incmp_pct) as "UNFINISHED %" by rsti_thumb_print | replace "rsti_fvcad_ds_Thu_May_10_22_06_55_2018_fvcad-jenkins-01_fvcad_ds" WITH RUN1, "rsti_fvcad_ds_Thu_May_10_03_45_41_2018_fvcad-jenkins-01_fvcad_ds OR rsti_thumb_print=rsti_c_vidyak_Thu_May_31_03_44_55_2018_vl-c-vidyak-ice_c_vidyak" WITH RUN2 IN rsti_thumb_print

I tried replace command, but it is working only for some extent. Since i'm relying on one token to get some values, that token has default delimeter as "OR rsti_thumb_print=". So due to this the replace command is failing.

Any help will be appreciated.
alt text

Tags (2)
0 Karma

PowerPacked
Builder

Hi @Maniteja81

You can use this settings on the right hand top side of the dashboard panel to make the changes

alt text

the legend truncation gives you option to choose the y axis field values to be shown as - starting, start..end, ending.

if you want to change the field values completely, you may need to rename them in the search only.

Thanks

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...