Renaming data series

Comments

2 comments

  • Avatar
    Graham Watts

    Hey Mark,

    You can use a simple If() statement like this:

     _sourceCategory=auth0/logs/dev
        | json auto  
        | where client_name = "Auth0 Client 1" or client_name = "Auth0 Client 2"
        | where type matches "s" or type matches "ssa" or type matches "fp" or type matches "fu"
        | if (type="fp", "failed password", type) as type
        | if (type="ssa", "successful silent auth", type) as type 
        | timeslice by 1d
        | sum
        | count by _timeslice, type
        | sort by type
        | transpose row _timeslice column type

    Or you can do a nested If() like this:

     _sourceCategory=auth0/logs/dev
        | json auto  
        | where client_name = "Auth0 Client 1" or client_name = "Auth0 Client 2"
        | where type matches "s" or type matches "ssa" or type matches "fp" or type matches "fu"
        | if (type="fp", "failed password",if (type="ssa", "successful silent auth", type)) as type
        | timeslice by 1d
        | sum
        | count by _timeslice, type
        | sort by type
        | transpose row _timeslice column type

    1
    Comment actions Permalink
  • Avatar
    Mark Drummond

    Thanks Graham!

    0
    Comment actions Permalink

Please sign in to leave a comment.