I would like one of the following outcomes:
1. Hover over the Bar and see the description but have the y-axis still show the message ID
2. Have a legend at the bottom of the chart translating the message ID to the description.
I have the search below with some changes for privacy reasons. Thanks for helping.
host=SERVERNAME source="audit.log"| rex "\"(?.+?)\",\"(?.+?)\",\"(?.+?)\",\"(?.+?)\",\"(?.+?)\",\"(?.+?)\"" | eval is_match=case("$accountoption$" == "X" AND !LIKE(AccountName, "%X%"),1, "$accountoption$" == "Y" AND LIKE(AccountName, "%Y%"),1, "$accountoption$" == "Z" AND !LIKE(AccountName, "%Z%"),1,1==1,0) | where is_match = 1 | stats count by MessageID | lookup statusmessage.csv MessageNum AS MessageID OUTPUT MessageDesc AS MessageID
... View more