Splunk Search

How to rename timechart legend static names with variable names

wti
Engager

Hello,
I have a timechart search (search code snippet below), everything works great.
The chart shows up and the legend shows "sample1", "sample2" .

What I would like to do is, Instead these of the static names I would like to put in a variable name, for example, $location$, but when I put $location$ in replacing sample2 I get the literal text "$location$" in my legend, sorry for such a newbie question but we are muddling our way through.

 | search siteid=$siteid$ location=$location$ 
| timechart avg("powerdata{}.sample1{}.current") assample1, avg("powerdata{}.sample2{}.current") as sample2 
| eval sample1=round(sample1,2) 
| eval sample2=round(sample2,2) 
0 Karma

vnravikumar
Champion

Hi

Check this

<dashboard>
  <label>timehart</label>
  <init>
    <set token="legend1">sample1_legend</set>
    <set token="legend2">sample2_legend</set>
  </init>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal 
| timechart eval(round(avg(date_second),2)) as $legend1$, eval(round(avg(date_hour),2)) as $legend2$</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
</dashboard>
0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...