My log snippet is as shown below:
I've a timechart with below query:
Here, I'm using case since I need to show legend in human readable format but the problem is that I may have more than 15 productids in future. And I don't want to hard code them all in case condition. Is there any other way to display legend without this comparision?
Any help is much appreciated!
asked 06 Mar '12, 11:33
Have you looked into using a lookup to translate productid to human readable product names?
Take a look at http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources?r=searchtip -> it's a really powerful and handy command.
answered 06 Mar '12, 12:00