Hello gurus. I have a panel with a STATS COUNT chart where the y-axis is numeric value. What we would like is a legend where the description of the y-axis number is given. I know that LOOKUP is involved but I am not sure how to send it to the legend. It cannot be a static table because there are thousands of message Descriptions and we only want to see the descriptions for detail in the chart. Thanks in advance.
Since the Legend functionality is limited i just cheated and added a table directly below to chart.
Go ahead and click Accept
on your answer to close the question.
I would like one of the following outcomes:
1. Hover over the Bar and see the description but have the y-axis still show the message ID
2. Have a legend at the bottom of the chart translating the message ID to the description.
I have the search below with some changes for privacy reasons. Thanks for helping.
host=SERVERNAME source="audit.log"| rex "\"(?.+?)\",\"(?.+?)\",\"(?.+?)\",\"(?.+?)\",\"(?.+?)\",\"(?.+?)\"" | eval is_match=case("$accountoption$" == "X" AND !LIKE(AccountName, "%X%"),1, "$accountoption$" == "Y" AND LIKE(AccountName, "%Y%"),1, "$accountoption$" == "Z" AND !LIKE(AccountName, "%Z%"),1,1==1,0) | where is_match = 1 | stats count by MessageID | lookup statusmessage.csv MessageNum AS MessageID OUTPUT MessageDesc AS MessageID
I assume you are doing something like:
... | stats count BY code
So you need to add this to it:
| lookup YourLookupDefinitionHere code OUTPUT description AS code
This is quite easy to do but you will need to provide some code showing what you are already doing so we can help you better 🙂